SOA-C03 practice question: Systems Manager for fleet operations (1 of 3)

Deployment, Provisioning, and Automation A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A public library manages 200 EC2 instances, both Windows Server and Amazon Linux, with AWS Systems Manager. Security patches must be installed every Sunday between 2:00 and 4:00 AM. To leave time for testing, a patch may be installed only after it has been released for at least 7 days. The library wants this enforced automatically. What should a CloudOps engineer configure?

Choose one answer.

A. Patch baselines with an auto-approval delay of 7 days, and a maintenance window on Sundays from 2:00 to 4:00 AM that runs AWS-RunPatchBaseline with Install.
B. A State Manager association that runs AWS-RunPatchBaseline with the Install operation every 30 minutes on all instances.
C. An Automation runbook started each Sunday at 2:00 AM by an EventBridge schedule that applies all available updates with the operating system's package manager.
D. Run Command with AWS-RunPatchBaseline and the Scan operation every Sunday, then have the team approve each patch in the console.

Show the answer and explanation

Answer: A

A. Right: Correct. Approval rules in a patch baseline can approve patches a set number of days after release. The maintenance window runs the patching task only during the allowed time. Learn more: Patch baselines (opens in a new tab)
B. Wrong: This would install patches throughout the week, outside the Sunday window. It also does not delay approval until patches are 7 days old. Learn more: AWS Systems Manager State Manager (opens in a new tab)
C. Wrong: This keeps to the time window, but it installs every update regardless of release date. It also loses the patch compliance reporting that Patch Manager provides. Learn more: AWS Systems Manager Automation (opens in a new tab)
D. Wrong: The Scan operation only reports missing patches and installs nothing. Manual approval each week is the work the library wants to automate. Learn more: AWS Systems Manager Patch Manager (opens in a new tab)

Explanation

Patch Manager separates what is approved from when it is installed. Patch baselines decide which patches are approved, including an approval delay after release, and maintenance windows decide when AWS-RunPatchBaseline installs them. Together they enforce both rules without manual steps.

SOA-C03 practice question: Systems Manager for fleet operations (1 of 3)

Explanation

Study

Keep practicing