ExamPark
Course menuDOP-C02

Exams / DOP-C02 / Systems Manager Automation, State Manager and patching / Question 1

DOP-C02 practice question: Systems Manager Automation, State Manager and patching (1 of 2)

Configuration Management and IaC A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

An airline runs about 900 Amazon EC2 Windows and Linux instances across three accounts. The instances are tagged by role, and the operations team patches them once a month, outside the peak booking hours.

Auditors need a monthly report that shows, for each instance, which patches were installed and which instances are still noncompliant. The team wants patching to reboot instances only inside the maintenance window and to keep a record of each run.

The team wants to avoid writing and maintaining its own patching scripts.

Which approach meets these requirements with the LEAST operational overhead?

Choose one answer.

  1. A. Schedule a cron job on each instance that runs the operating system's update command at night, and have the job write its output to a central log bucket for the auditors.
  2. B. Use Systems Manager Patch Manager with per-OS patch baselines and a maintenance window that targets the tagged instances, set to install patches and allow reboots.
  3. C. Run an AWS Systems Manager Run Command document on all 900 instances every month, and have the operations team check each command's output by hand before the auditors meet.
  4. D. Configure AWS Config rules that check whether each instance has the latest patches, and create an alert that tells the operations team which instances are noncompliant.
Show the answer and explanation

Answer: B

  • A. Wrong: A cron job on each instance is custom patching that the team would maintain. Its output is hard to turn into compliance records, and it does not coordinate reboots across the fleet.
  • B. Right: Correct. Patch Manager applies approved patches from a baseline during maintenance windows, controls reboots, and records patch compliance and history for each instance. The team uses managed baselines rather than its own scripts. Learn more: AWS Systems Manager Patch Manager (opens in a new tab)
  • C. Wrong: Run Command can run the update, but it does not provide patch baselines or a compliance report by default. The manual review is slow and does not produce the monthly record the auditors need. Learn more: AWS Systems Manager Run Command (opens in a new tab)
  • D. Wrong: Config can evaluate compliance, but the rules report only; they do not install patches or reboot instances in the window. The team would still need a separate process to remediate. Learn more: Evaluating Resources with AWS Config Rules (opens in a new tab)

Explanation

Patch Manager uses patch baselines to decide which patches apply, runs them in maintenance windows with reboot control, and keeps compliance and patch history for each instance. Tag-based targets cover the fleet without per-instance scripts. Cron jobs, Run Command and Config rules each leave the team building or checking part of the process.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DOP-C02 practice examPractice Systems Manager Automation, State Manager and patchingAll Systems Manager Automation, State Manager and patching questions

Want more on Systems Manager Automation, State Manager and patching? The 5 full-length practice sets have 7 more Systems Manager Automation, State Manager and patching questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets