SOA-C03 practice question 7 of 10

A company's AWS accounts are in an organization in AWS Organizations. The organization has all features enabled. The accounts use Amazon EC2…

Domain Deployment, Provisioning, and Automation

A company's AWS accounts are in an organization in AWS Organizations. The organization has all features enabled. The accounts use Amazon EC2 instances to host applications. The company manages the EC2 instances manually by using the AWS Management Console. The company applies updates to the EC2 instances by using an SSH connection to each EC2 instance. The company needs a solution that uses AWS Systems Manager to manage all the organization's current and future EC2 instances. The latest version of Systems Manager Agent (SSM Agent) is running on the EC2 instances. Which solution will meet these requirements?

Answer options

A: Configure a home AWS Region in Systems Manager Quick Setup in the organization's management account. Deploy the Systems Manager Default Host Management Configuration Quick Setup from the management account. Correct answer

B: Configure a home AWS Region in Systems Manager Quick Setup in the organization's management account. Create a Systems Manager Run Command that attaches the AmazonSSMServiceRolePolicy IAM policy to every IAM role that the EC2 instances use. Invoke the command in every account in the organization.

C: Create an AWS CloudFormation stack set that contains a Systems Manager parameter to define the Default Host Management Configuration role. Use the organization's management account to deploy the stack set to every account in the organization.

D: Create an AWS CloudFormation stack set that contains an EC2 instance profile with the AmazonSSMManagedEC2InstanceDefaultPolicy IAM policy attached. Use the organization's management account to deploy the stack set to every account in the organization.

Correct Answer:

A. Configure a home AWS Region in Systems Manager Quick Setup in the organization's management account. Deploy the Systems Manager Default Host Management Configuration Quick Setup from the management account.

Explanation

AWS Systems Manager Quick Setup is designed to simplify the configuration of Systems Manager and other services across an entire AWS Organization. By using the "Default Host Management Configuration" from the organization's management account, an administrator can automate the deployment of the necessary IAM roles and configurations to all member accounts and specified Regions. This is achieved through the use of AWS CloudFormation StackSets, which Quick Setup manages automatically. This approach ensures that all current and future EC2 instances in the organization are configured for Systems Manager, meeting the requirements for a scalable, organization-wide management solution.

Why Incorrect

B: AWS Systems Manager Run Command executes scripts on managed instances; it cannot be used to modify IAM policies or roles, which are account-level resources managed through the IAM service. C: This describes a manual and incorrect way of using AWS CloudFormation StackSets. The "Default Host Management Configuration" is a pre-packaged Quick Setup configuration, not a parameter you define in a custom template. D: This solution is incomplete. While creating an instance profile with the correct policy via a StackSet is a valid step, it does not attach the profile to existing or future instances, nor does it configure Systems Manager services like patching or inventory.

References

1. AWS Systems Manager User Guide, "AWS Systems Manager Quick Setup": This section states, "Quick Setup... helps you quickly configure frequently used AWS services and features with recommended best practices... You can use Quick Setup in an individual AWS account or across multiple AWS accounts and AWS Regions by integrating with AWS Organizations." This supports using Quick Setup for an organization-wide deployment.

2. AWS Systems Manager User Guide, "Quick Setup Host Management": This page details the "Default Host Management Configuration" option. It specifies that this configuration "deploys the AWS-SystemsManager-EC2-SSM-Ready-Role IAM instance profile to your accounts and Regions" and configures instances for core Systems Manager capabilities like inventory, patch scanning, and agent updates. This confirms that Option A provides a complete solution.

3. AWS Systems Manager User Guide, "Setting up Systems Manager for multi-account and multi-Region environments": This section explicitly recommends Quick Setup as the method for configuring Systems Manager across an organization. It notes, "We recommend that you use Quick Setup... to configure your instances for Systems Manager... Quick Setup uses AWS CloudFormation StackSets to create the required IAM instance profile role and configure your instances." This directly validates the approach in Option A.

Question breakdown

Tests: Enable Systems Manager management across an AWS Organization
Difficulty: Medium

Key idea: Deploying Default Host Management Configuration through Quick Setup from the management account makes EC2 instances in all current and future member accounts managed by Systems Manager, without editing instance profiles.

How to reach the answer

The clues are 'all current and future EC2 instances' across an organization with all features enabled.
Default Host Management Configuration (DHMC) lets SSM Agent connect using a service-level role, so no per-instance profile changes are needed.
Quick Setup integrates with Organizations and uses StackSets to push the configuration to member accounts and Regions.
Quick Setup requires a home Region to be set in the management account first.
Custom StackSets or Run Command approaches are either incomplete or technically invalid.

Each option

ACorrect. Quick Setup DHMC from the management account applies to the whole organization, including accounts added later.
BIncorrect. Run Command runs commands on instances and is not the mechanism for attaching IAM policies; AmazonSSMServiceRolePolicy is also the wrong policy for instances.
CIncorrect. DHMC is enabled through the Systems Manager service setting and role, not through a parameter defined in a custom stack set.
DIncorrect. Creating an instance profile does not attach it to existing or future instances, so those instances would not become managed.

Common trap: Option D seems sensible because that policy is the right one for SSM, but an unattached instance profile does nothing for the instances.

In practice: Teams moving from SSH-based administration to Session Manager and Patch Manager use DHMC through Quick Setup to bring every account under management in one step.

Remember: For organization-wide Systems Manager onboarding, deploy DHMC with Quick Setup from the management account.

Official documentation: AWS Systems Manager Quick Setup · Configure Default Host Management Configuration with Quick Setup

Reviewed by David Mercer.

Keep practicing

Take the free SOA-C03 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test