Q64 — AWS SAA-C03 Ch.17

Question 64 of 89 | ← Chapter 17

Q1364. A company hosts dozens of multi-tier applications on AWS. The presentation layer and logic layer are comprised of Amazon EC2 Linux instances that use Amazon EBS volumes.The company needs a solution to ensure that operating system vulnerabilities are not introduced to the EC2 instances when the company deploys new features. The company uses custom AMIs to deploy the EC2 instances in an Auto Scaling group.The solution must scale to the handle all applications that the company hosts.Which solution will meet these requirements?

Correct Answer: D. Use EC2 Image Builder to create new AMIs when the company deploys new features. Include the update-linux component in the build components of the new AMIs. Use the existing Auto Scaling group to deploy the new AMIs.

Explanation

The correct answer is D. Use EC2 Image Builder to create new AMIs when the company deploys new features. Include the update-linux component in the build components of the new AMIs. Use the existing Auto Scaling group to deploy the new AMIs.Explanation:The company needs a scalable, automated, and secure solution to:Prevent OS vulnerabilities in EC2 instances deployed via custom AMIs.Ensure consistency across all multi-tier applications.Integrate with Auto Scaling groups for seamless deployment.Why Option D is the Best Choice:EC2 Image BuilderAutomates AMI creation Ensures all instances are built from a secure, standardized image. Includes update-linux component Automatically applies OS patches and security updates during AMI builds.Scalable Can handle dozens of applications without manual intervention. Integrates with Auto Scaling New AMIs can be rolled out automatically via existing Auto Scaling groups.Prevents Vulnerabilities at Deployment TimeBy baking security updates into the AMI, instances are secure from launch (unlike post-deployment patching).Reduces attack surface compared to patching running instances (which may have already been compromised).Why Other Options Are Incorrect:A. Use Amazon Inspector to patch vulnerabilitiesInspector only detects vulnerabilities Does not patch them. Post-deployment scanning Instances may remain vulnerable until scanned and patched (risk window). No AMI automation Does not ensure future deployments are secure.B. Use AWS Backup + EBS snapshots for AMIsBackups do not include security updates Restoring from a backup may reintroduce vulnerabilities. Manual process Creating AMIs from backups is error-prone and not scalable. No proactive security Relies on reactive backups instead of preventive patching.C. Use AWS Systems Manager Patch Manager on custom AMIsPatch Manager applies updates to running instances Does not update the AMI itself. Instances may still launch with old, vulnerable AMIs Security gaps until Patch Manager runs. Not scalable for dozens of applications Requires manual or scheduled patching per instance.Comparison Table:OptionPrevents Vulnerabilities at AMI Creation?Automated & Scalable?Integrates with Auto Scaling?Best ForD(Updates baked into AMI)(EC2 Image Builder)(Seamless deployment)Proactive security at scale A (Only detects, no patching) (Manual post-scan) (No AMI impact)Vulnerability scanning (not prevention) B (Backups don't patch) (Manual AMI creation) (No direct integration)Disaster recovery (not security) C (Patches running instances only) (Per-instance patching) (AMIs remain vulnerable)Post-deployment patching (reactive)Conclusion:Option D is the most secure, scalable, and automated solution because:EC2 Image Builder ensures AMIs are pre-patched No vulnerable instances at launch. update-linux component automates OS updates Reduces human error. Works with Auto Scaling No disruption to existing deployments.Avoid Options A, B, and C (they either fail to prevent vulnerabilities or are not scalable).Final Answer: D