Topic 1 Question 251
A DevOps engineer needs to implement a solution to install antivirus software on all the Amazon EC2 instances in an AWS account. The EC2 instances run the most recent version of Amazon Linux.
The solution must detect all instances and must use an AWS Systems Manager document to install the software if the software is not present.
Which solution will meet these requirements?
Create an association in Systems Manager State Manager. Target all the managed nodes. Include the software in the association. Configure the association to use the Systems Manager document.
Set up AWS Config to record all the resources in the account. Create an AWS Config custom rule to determine if the software is installed on all the EC2 instances. Configure an automatic remediation action that uses the Systems Manager document for noncompliant EC2 instances.
Activate Amazon EC2 scanning on Amazon Inspector to determine if the software is installed on all the EC2 instances. Associate the findings with the Systems Manager document.
Create an Amazon EventBridge rule that uses AWS CloudTrail to detect the Runinstances API call. Configure inventory collection in Systems Manager Inventory to determine if the software is installed on the EC2 instances. Associate the Systems Manager inventory with the Systems Manager document.
ユーザの投票
コメント(6)
- 正解だと思う選択肢: A
By creating an association, you can ensure that all instances have the antivirus software installed and kept up-to-date.
👍 2trungtd2024/07/17 ---> I'm between A & D Not 100% sure about this but here are my 2 cents about DETECTING the instances that don't have the software installed:
A - it's a bit tricky because it states that it targets all managed nodes - but what if there are other nodes that are not managed? It just assumes that all instances are managed by AWS Systems Manager
B - How can Config determine if the software is installed?
C - Amazon Inspector is focused on security assessments and compliance checks, not on ensuring software is installed. It would require additional setup and is not designed for direct software installation.
D - it ensures that all instances are detected. It ensures that the installed software is tracked by using the AWS Systems Manager Inventory (which is designed for this kind of things). I'm not 100% sure about the phrase "Associate the Systems Manager inventory with the Systems Manager document." which I don't believe its technically possible
👍 1tgv2024/07/16State Manager associations A State Manager association is a configuration that you assign to your AWS resources. The configuration defines the state that you want to maintain on your resources. For example, an association can specify that antivirus software must be installed and running on a managed node, or that certain ports must be closed.
An association specifies a schedule for when to apply the configuration and the targets for the association. For example, an association for antivirus software might run once a day on all managed nodes in an AWS account. If the software isn't installed on a node, then the association could instruct State Manager to install it. If the software is installed, but the service isn't running, then the association could instruct State Manager to start the service.
👍 1d0229a22024/07/24
シャッフルモード