SOA-C03 practice question 2 of 10

A company's developers manually install software modules on Amazon EC2 instances to deploy new versions of a service. A security audit finds that instances contain inconsistent and unapproved modules. A CloudOps engineer must create a new instance image that contains only approved software. Which solution will meet these requirements?

Domain Deployment, Provisioning, and Automation

Answer options

A: Use Amazon Detective to continuously find and uninstall unauthorized modules from the instances.

B: Use Amazon GuardDuty to create and deploy an Amazon Machine Image (AMI) that includes only the approved modules.

C: Use AWS Systems Manager Run Command to install the approved modules on all running instances during an in-place update.

D: Use EC2 Image Builder to create and test an Amazon Machine Image (AMI) that includes only the approved modules. Update the deployment workflow to use the new AMI. Correct answer

Correct Answer:

D. Use EC2 Image Builder to create and test an Amazon Machine Image (AMI) that includes only the approved modules. Update the deployment workflow to use the new AMI.

Explanation

EC2 Image Builder is a fully managed AWS service designed to automate the creation, management, and deployment of customized, secure, and up-to-date server images, known as Amazon Machine Images (AMIs). It allows an organization to define a pipeline that starts with a base image, applies customizations and software installations (components), runs tests to validate the image, and then distributes the final, approved AMI. This directly addresses the requirement to create a standardized instance image with only approved software, resolving the issue of configuration drift and unapproved modules caused by manual installations. Updating the deployment workflow to use this "golden AMI" ensures consistency and security for all new instances.

Why Incorrect

A. Amazon Detective is a security service that analyzes log data to help investigate the root cause of security findings; it does not modify or manage software on instances.
B. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior; it does not have capabilities for creating or deploying AMIs.
C. AWS Systems Manager Run Command executes commands on existing instances. While it can install software, it does not create a new, reusable AMI, which is the core requirement to prevent future inconsistencies.

References

1. EC2 Image Builder User Guide: "EC2 Image Builder is a fully managed AWS service that helps you automate the creation

management

and deployment of customized

secure

and up-to-date server images that are pre-installed and pre-configured with software and settings to meet specific IT standards."

Source: AWS Documentation

EC2 Image Builder User Guide

"What is EC2 Image Builder?".

2. AWS Systems Manager User Guide: "Run Command

a capability of AWS Systems Manager

lets you remotely and securely manage the configuration of your managed nodes. ... Run Command enables you to automate common administrative tasks and perform ad hoc configuration changes at scale."

Source: AWS Documentation

AWS Systems Manager User Guide

"Systems Manager Run Command".

3. Amazon GuardDuty User Guide: "Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation."

Source: AWS Documentation

Amazon GuardDuty User Guide

"What is Amazon GuardDuty?".

4. Amazon Detective Administration Guide: "Amazon Detective automatically collects log data from your AWS resources and uses machine learning

statistical analysis

and graph theory to build a linked set of data that enables you to easily conduct faster and more efficient security investigations."

Source: AWS Documentation

Amazon Detective Administration Guide

"What is Amazon Detective?".

Question breakdown

Tests: Build standardized golden AMIs for consistent EC2 deployments
Difficulty: Easy

Key idea: EC2 Image Builder automates building, testing, and distributing hardened AMIs, so deployments start from an approved, consistent image.

How to reach the answer

The requirement is to create a new instance image, which means an AMI.
The image must contain only approved software, so the build should be repeatable and testable.
Detective and GuardDuty investigate and detect security issues; neither builds images.
Run Command patches existing instances but produces no reusable image.
Image Builder pipelines with components and tests meet the requirement directly.

Each option

AIncorrect. Amazon Detective investigates security findings and cannot uninstall software or build images.
BIncorrect. GuardDuty detects threats and has no AMI creation or deployment capability.
CIncorrect. An in-place update with Run Command leaves drift on running instances and creates no new image.
DCorrect. Image Builder produces a tested AMI that contains only approved components, and pointing deployments at that AMI enforces consistency.

Common trap: Run Command looks attractive because it can install the approved modules fleet-wide, but it fixes running instances instead of producing the required image.

In practice: Platform teams run Image Builder pipelines on a schedule to produce patched golden AMIs, then reference them in launch templates for Auto Scaling groups.

Remember: When a question asks for a new image with approved software, think EC2 Image Builder plus launch templates.

Official documentation: What is EC2 Image Builder?

Reviewed by David Mercer.

Keep practicing

Take the free SOA-C03 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test