Q96 — AWS SAA-C03 Ch.12

Question 96 of 100 | ← Chapter 12

Q896. A company has migrated a fleet of hundreds of on-premises virtual machines (VMs) to Amazon EC2 instances. The instances run a diverse fleet of Windows Server versions along with several Linux distributions. The company wants a solution that will automate inventory and updates of the operating systems. The company also needs a summary of common vulnerabilities of each instance for regular monthly reviews.What should a solutions architect recommend to meet these requirements?

Correct Answer: B. Set up AWS Systems Manager Patch Manager to manage all the EC2 instances. Deploy Amazon Inspector, and configure monthly reports.

Explanation

AWS Systems Manager Patch Manager provides a centralized solution for automating the patching of operating systems on EC2 instances. It supports both Windows and Linux distributions, which aligns with the diverse fleet of instances in this scenario. With Patch Manager, you can define patch baselines, schedule patching operations, and track the compliance of instances with the defined patch policies.Amazon Inspector is a security assessment service that helps identify vulnerabilities and security issues within applications and operating systems. By deploying Amazon Inspector, you can scan your EC2 instances for common vulnerabilities and receive detailed findings and recommendations.By configuring monthly reports, you can review the summary of common vulnerabilities for the EC2 instances regularly. This will provide insights into the security posture of the instances and help prioritize remediation efforts.Option A suggests setting up AWS Systems Manager Patch Manager to manage the EC2 instances and configuring AWS Security Hub to produce monthly reports. While Security Hub provides a comprehensive view of the security status of your environment, it does not directly address the requirement of automating inventory and updates of operating systems. Therefore, Option A is not the most suitable solution.Option C suggests setting up AWS Shield Advanced and deploying AWS Config to automate patch installations on the EC2 instances. AWS Shield Advanced is a DDoS protection service and does not provide the necessary capabilities for automating inventory and updates of operating systems. AWS Config can help with tracking changes to resources but does not provide patch management capabilities.Option D suggests setting up Amazon GuardDuty to monitor the EC2 instances and deploying AWS Config to automate patch installations. While GuardDuty is a threat detection service, it does not directly address the requirement of automating inventory and patch updates. AWS Config can help with tracking changes but does not provide patch management capabilities.In summary, to meet the requirement of automating inventory and updates of the operating systems for a fleet of EC2 instances, along with providing a summary of common vulnerabilities for regular monthly reviews, setting up AWS Systems Manager Patch Manager to manage the instances, deploying Amazon Inspector for vulnerability assessments, and configuring monthly reports (Option B) is the appropriate solution.