A company is using AWS Organizations. They want to ensure that any new EC2 instance launched in any account automatically has the AWS Systems Manager (SSM) Agent installed and is managed by SSM. They also want to automatically apply critical OS patches every weekend. What is the MOST operationally efficient way to achieve this?

Answer options:

Create a custom AMI with the SSM Agent installed. Enforce its use via SCP.

Use Default Host Management Configuration (DHMC) in Systems Manager to automatically manage all instances. Configure SSM Patch Manager with a maintenance window.

Deploy an AWS Config rule to detect unmanaged instances and trigger a Lambda function to attach an IAM role.

Use AWS CloudFormation StackSets to deploy an IAM instance profile to all accounts and attach it manually to instances.

How to approach this question

Look for the newest, most automated SSM feature (DHMC).

Full Answer

B.Use Default Host Management Configuration (DHMC) in Systems Manager to automatically manage all instances. Configure SSM Patch Manager with a maintenance window.✓ Correct

Default Host Management Configuration (DHMC) allows Systems Manager to automatically manage EC2 instances without the need to manually attach an IAM instance profile. SSM Patch Manager can then be used to automate patching across the organization.

Common mistakes

Relying on legacy methods like custom AMIs or manual IAM role attachment.

Question 35 All questions Question 37

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 4

75 questions · hints · full answers · grading

More questions from this exam

Q01A global enterprise is redesigning its network architecture across 50 AWS accounts. They require ...Hard Q02A financial services company uses AWS Organizations to manage 100+ accounts. The security team ma...Medium Q03An e-commerce company requires a multi-region active-active architecture for its critical order p...Medium Q04A company is setting up a new AWS environment using AWS Control Tower. They need to ensure that a...Hard Q05An enterprise has 50 AWS accounts under AWS Organizations. They want to implement a chargeback mo...Medium

View all 75 questions →