Amazon Exam SCS-C02 Topic 2 Question 32 Discussion

Actual exam question for Amazon's SCS-C02 exam

Question #: 32
Topic #: 2

A company has AWS accounts in an organization in AWS Organizations. The company needs to install a corporate software package on all Amazon EC2 instances for all the accounts in the organization.

A central account provides base AMIs for the EC2 instances. The company uses AWS Systems Manager for software inventory and patching operations.

A security engineer must implement a solution that detects EC2 instances ttjat do not have the required software. The solution also must automatically install the software if the software is not present.

Which solution will meet these requirements?

AProvide new AMIs that have the required software pre-installed. Apply a tag to the AMIs to indicate that the AMIs have the required software. Configure an SCP that allows new EC2 instances to be launched only if the instances have the tagged AMIs. Tag all existing EC2 instances.

BConfigure a custom patch baseline in Systems Manager Patch Manager. Add the package name for the required software to the approved packages list. Associate the new patch baseline with all EC2 instances. Set up a maintenance window for software deployment.

CCentrally enable AWS Config. Set up the ec2-managedinstance-applications-required AWS Config rule for all accounts Create an Amazon EventBridge rule that reacts to AWS Config events. Configure the EventBridge rule to invoke an AWS Lambda function that uses Systems Manager Run Command to install the required software.

DCreate a new Systems Manager Distributor package for the required software. Specify the download location. Select all EC2 instances in the different accounts. Install the software by using Systems Manager Run Command.

Show Suggested Answer

Suggested Answer: C

Utilizing AWS Config with a custom AWS Config rule (ec2-managedinstance-applications-required) enables detection of EC2 instances lacking the required software across all accounts in an organization. By creating an Amazon EventBridge rule that triggers on AWS Config events, and configuring it to invoke an AWS Lambda function, automated actions can be taken to ensure compliance. The Lambda function can leverage AWS Systems Manager Run Command to install the necessary software on non-compliant instances. This approach ensures continuous compliance and automated remediation, aligning with best practices for cloud security and management.

by Shad at Sep 15, 2024, 08:12 AM

Limited Time Offer

25%

Off

Get Premium SCS-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Vincent

2 months ago

I'm not sure about option C. I think option A could also work by providing new AMIs with the software pre-installed and tagging them for easy identification.

upvoted 0 times

...

Geraldine

2 months ago

I agree with Micaela. Using AWS Config with EventBridge and Lambda function to install the software centrally is efficient and effective.

upvoted 0 times

...

Ira

2 months ago

Wow, these options are all quite technical. I'd need a Ph.D. in AWS to understand them properly. Maybe I should just ask Alexa for help.

upvoted 0 times

...

3 months ago

Option C seems like the most comprehensive solution. Leveraging AWS Config, EventBridge, and Lambda to automate the process is a clever approach.

upvoted 0 times

Julieta

1 months ago

Definitely, having that level of automation can save a lot of time and ensure consistency across all accounts.

upvoted 0 times

...

Twanna

1 months ago

It's important to have a solution that can automatically detect and install the required software on all EC2 instances.

upvoted 0 times

...

Kerry

1 months ago

I agree, using AWS Config, EventBridge, and Lambda together can definitely automate the process effectively.

upvoted 0 times

...

Malcolm

2 months ago

Option C seems like the most comprehensive solution.

upvoted 0 times

...

Micaela

3 months ago

I think option C is the best solution. Enabling AWS Config and setting up the required rule seems like a good way to detect and install the software.

upvoted 0 times

...