Systems Manager Automation, State Manager and patching: DOP-C02 study notes and practice questions
What to know about Systems Manager Automation, State Manager and patching for the DOP-C02 exam, from the Configuration Management and IaC domain (17% of the exam guide), then 2 free questions to test it. Part of the DOP-C02 study guide.
Systems Manager questions ask how to change or patch many servers safely without logging in to them.
Capabilities
Capability
Use
Automation
Multi-step runbooks (AWS-provided or your own) for tasks like patching an AMI, restarting a service or remediating a Config finding; steps can call APIs, run scripts, wait for approval and branch
Run Command
Run a command document on many instances now
State Manager
Keep instances in a defined state on a schedule (associations), such as agent installed or settings applied
Patch Manager
Patch baselines, patch groups and compliance reporting; patch in maintenance windows with reboot control
Maintenance Windows
Schedule tasks in agreed time slots
Parameter Store
Configuration and secrets (SecureString)
Session Manager
Shell access through IAM with logging, no SSH keys or open ports
Inventory and Compliance
What’s installed and whether it meets baselines
Distributor
Package and install software
Running safely at scale
Targets by tags, resource groups or all instances.
Rate controls:concurrency (how many at once) and error threshold (how many failures stop the run). A concurrency of one with an error threshold of one stops at the first failure.
Multi-account and multi-Region Automation from a central account.
Approval steps (aws:approve) pause for named approvers.
Requirements
Instances need the SSM Agent and an instance profile with AmazonSSMManagedInstanceCore, plus a network path to Systems Manager (VPC endpoints in private subnets). Default Host Management Configuration can grant this to all instances automatically.
Common traps
SSH loops in scripts across hundreds of servers.
Patching everything at once with no rate control.
Opening port 22 for admins when Session Manager logs sessions without it.
An airline runs about 900 Amazon EC2 Windows and Linux instances across three accounts. The instances are tagged by role, and the operations team patches them once a month, outside the peak booking hours.
Auditors need a monthly report that shows, for each instance, which patches were installed and which instances are still noncompliant. The team wants patching to reboot instances only inside the maintenance window and to keep a record of each run.
The team wants to avoid writing and maintaining its own patching scripts.
Which approach meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Schedule a cron job on each instance that runs the operating system's update command at night, and have the job write its output to a central log bucket for the auditors.
BB. Use Systems Manager Patch Manager with per-OS patch baselines and a maintenance window that targets the tagged instances, set to install patches and allow reboots.
CC. Run an AWS Systems Manager Run Command document on all 900 instances every month, and have the operations team check each command's output by hand before the auditors meet.
DD. Configure AWS Config rules that check whether each instance has the latest patches, and create an alert that tells the operations team which instances are noncompliant.
Show the answer and explanation
Answer: B
A. Wrong: A cron job on each instance is custom patching that the team would maintain. Its output is hard to turn into compliance records, and it does not coordinate reboots across the fleet.
B. Right: Correct. Patch Manager applies approved patches from a baseline during maintenance windows, controls reboots, and records patch compliance and history for each instance. The team uses managed baselines rather than its own scripts. Learn more: AWS Systems Manager Patch Manager (opens in a new tab)
C. Wrong: Run Command can run the update, but it does not provide patch baselines or a compliance report by default. The manual review is slow and does not produce the monthly record the auditors need. Learn more: AWS Systems Manager Run Command (opens in a new tab)
Patch Manager uses patch baselines to decide which patches apply, runs them in maintenance windows with reboot control, and keeps compliance and patch history for each instance. Tag-based targets cover the fleet without per-instance scripts. Cron jobs, Run Command and Config rules each leave the team building or checking part of the process.
A hospital network runs a clinical-messaging agent on 400 Linux servers. The agent must be upgraded across the fleet in a way that keeps at least one server in each hospital serving messages at all times.
The upgrade is an Automation runbook that a change board must approve before it touches production servers. If any server fails the upgrade, the rollout should stop before the next server is changed, so that the number of affected servers stays small.
The team wants the approval and the rollout controls handled by Systems Manager itself, without writing a separate workflow engine.
Which configuration meets these requirements?
Choose one answer.
AA. Add an aws:approve step for the change board, and run the runbook on the tagged servers with a concurrency of one and an error threshold of zero.
BB. Run the runbook against all 400 servers at once with a maximum concurrency of 50 and an error threshold of 50, and have the change board review the results afterwards.
CC. Trigger the runbook from an EventBridge rule whenever a new agent version is published to the S3 bucket, so that each server upgrades as soon as the package appears.
DD. Copy the upgrade commands into a Run Command document, run it on each server by hand from a spreadsheet of server names, and record the approvals in the spreadsheet.
Show the answer and explanation
Answer: A
A. Right: Correct. An approval step pauses the runbook until the change board approves, and rate controls set how many targets run at once. With concurrency at one and an error threshold of zero, Automation stops sending the runbook to new servers after the first failure. Learn more: Control automations at scale (opens in a new tab)
Systems Manager Automation runbooks can include an approval step, and rate controls set how many targets run at once and how many errors stop the execution. A concurrency of one with an error threshold of zero updates one server at a time and stops at the first failure. Parallel runs, automatic triggers and manual spreadsheets each skip approval or the stop behavior.
Want more on Systems Manager Automation, State Manager and patching? The 5 full-length practice sets have 7 more Systems Manager Automation, State Manager and patching questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Systems Manager Automation, State Manager and patching