Q23 — AWS SAA-C03 Ch.13

Question 23 of 100 | ← Chapter 13

Q923. A company wants to implement new security compliance requirements for its development team to limit the use of approved Amazon Machine Images (AMIs).The company wants to provide access to only the approved operating system and software for all its Amazon EC2 instances.The company wants the solution to have the least amount of lead time for launching EC2 instances.Which solution will meet these requirements?

• A. Create a portfolio by using AWS Service Catalog that includes only EC2 instances launched with approved AMIs. Ensure that all required software is preinstalled on the AMIs. Create the necessary permissions for developers to use the portfolio. ✓
• B. Create an AMI that contains the approved operating system and software by using EC2 Image Builder.Give developers access to that AMI to launch the EC2 instances
• C. Create an AMI that contains the approved operating system. Tell the developers to use the approved AMI. Create an Amazon EventBridge rule to run an AWS Systems Manager script when a new EC2 instance is launched. Configure the script to install the required software from a repository.
• D. Create an AWS Config rule to detect the launch of EC2 instances with an AMI that is not approved.Associate a remediation rule to terminate those instances and launch the instances again with the approved AMI. Use AWS Systems Manager to automatically install the approved software on the launch of an EC2 instance.

Correct Answer: A. Create a portfolio by using AWS Service Catalog that includes only EC2 instances launched with approved AMIs. Ensure that all required software is preinstalled on the AMIs. Create the necessary permissions for developers to use the portfolio.

Explanation

The best solution to meet the company's requirements with the least amount of lead time for launching EC2 instances is:A. Create a portfolio by using AWS Service Catalog that includes only EC2 instances launched with approved AMIs. Ensure that all required software is preinstalled on the AMIs. Create the necessary permissions for developers to use the portfolio.Here's why:Pre-Approved AMIs: AWS Service Catalog allows you to create a portfolio of pre-approved resources, including EC2 instances launched with specific AMIs. This ensures that developers only have access to approved configurations.Pre-Installed Software: By pre-installing the required software on the AMIs, you eliminate the need for developers to manually install it after launching instances. This significantly reduces the lead time for getting instances up and running.Simplified Access: Developers can easily launch EC2 instances from the Service Catalog portfolio, without needing to manually select AMIs or install software. This streamlines the process and minimizes the risk of using unauthorized configurations.Why other options are less efficient:B. Create an AMI that contains the approved operating system and software by using EC2 Image Builder. Give developers access to that AMI to launch the EC2 instances While this approach provides a pre-configured AMI, it still requires developers to manually select the AMI, which can lead to errors and increase lead time.C. Create an AMI that contains the approved operating system. Tell the developers to use the approved AMI. Create an Amazon EventBridge rule to run an AWS Systems Manager script when a new EC2 instance is launched. Configure the script to install the required software from a repository. This approach relies on post-launch automation, which can add time to the instance launch process. It also requires developers to manually select the approved AMI.D. Create an AWS Config rule to detect the launch of EC2 instances with an AMI that is not approved. Associate a remediation rule to terminate those instances and launch the instances again with the approved AMI. Use AWS Systems Manager to automatically install the approved software on the launch of an EC2 instance. This approach is reactive and can lead to delays due to instance termination and re-launch. It also involves complex configuration and can be disruptive to developers.In summary:Using AWS Service Catalog with pre-configured AMIs and pre-installed software (option A) provides the most efficient and secure solution for the company, minimizing lead time and ensuring compliance with security requirements.