AWS Certified DevOps Engineer – Professional (DOP-C02) — Question 243

A DevOps engineer needs to implement a solution to install antivirus software on all the Amazon EC2 instances in an AWS account. The EC2 instances run the most recent version of Amazon Linux.

The solution must detect all instances and must use an AWS Systems Manager document to install the software if the software is not present.

Which solution will meet these requirements?

Answer options

• A. Create an association in Systems Manager State Manager. Target all the managed nodes. Include the software in the association. Configure the association to use the Systems Manager document.
• B. Set up AWS Config to record all the resources in the account. Create an AWS Config custom rule to determine if the software is installed on all the EC2 instances. Configure an automatic remediation action that uses the Systems Manager document for noncompliant EC2 instances.
• C. Activate Amazon EC2 scanning on Amazon Inspector to determine if the software is installed on all the EC2 instances. Associate the findings with the Systems Manager document.
• D. Create an Amazon EventBridge rule that uses AWS CloudTrail to detect the Runinstances API call. Configure inventory collection in Systems Manager Inventory to determine if the software is installed on the EC2 instances. Associate the Systems Manager inventory with the Systems Manager document.

Correct answer: A

Explanation

The correct answer is A because it directly uses AWS Systems Manager State Manager to manage the installation of the software across all targeted instances, which meets the requirement for detection and installation. Option B, while useful for compliance checks, does not directly install the software. Option C focuses on scanning instead of installation, and Option D involves event detection and inventory collection, which is not as direct as using State Manager for installation.