SOA-C03 practice question: Automated remediation with Systems Manager (2 of 2)

Monitoring, Logging, Analysis, Remediation, and Performance Optimization A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A regional bank's engineer edited the SSH daemon configuration on an EBS-backed Amazon Linux reporting server with an unencrypted root volume and restarted it. The server now refuses all SSH connections, and the SSM Agent on it had been stopped weeks ago to save memory.

The team wants an AWS-provided, repeatable way to diagnose and repair common operating system connectivity problems on the instance, without building a recovery process themselves.

Which approach should the team use?

Choose one answer.

A. Run the AWSSupport-ExecuteEC2Rescue Automation runbook to repair the instance offline.
B. Connect with Session Manager and revert the SSH configuration file from the shell session.
C. Use Run Command with the AWS-RunShellScript document to restore the previous SSH configuration file.
D. Create an AMI from the instance and launch a new instance from it, then delete the original instance.

Show the answer and explanation

Answer: A

A. Right: Correct. This AWS-provided runbook stops the instance, attaches its root volume to a helper instance and runs EC2Rescue offline to fix common connectivity problems. Because the work happens on the helper instance, it does not need SSH or a session on the broken instance. Learn more: AWSSupport-ExecuteEC2Rescue runbook (opens in a new tab)
B. Wrong: Session Manager needs a running SSM Agent that can reach Systems Manager. The agent on this instance is stopped, so the session cannot start. Learn more: AWS Systems Manager Session Manager (opens in a new tab)
C. Wrong: Run Command also relies on the SSM Agent running on the instance. With the agent stopped, the command would never be delivered. Learn more: AWS Systems Manager Run Command (opens in a new tab)
D. Wrong: An AMI copies the root volume as it is, including the broken SSH configuration. The new instance would refuse connections in the same way. Learn more: Create an Amazon EBS-backed AMI (opens in a new tab)

Explanation

Systems Manager provides predefined runbooks for common repair jobs. AWSSupport-ExecuteEC2Rescue works on the instance's volume offline from a helper instance, so it does not depend on SSH or on a session with the broken instance. Session Manager and Run Command need that agent, and an AMI reproduces the broken configuration.

SOA-C03 practice question: Automated remediation with Systems Manager (2 of 2)

Explanation

Study

Keep practicing