DOP-C02 Practice Question 44: State Manager Configuration Drift
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 5 · question 4 of 10
Security requires that a specific CloudWatch agent configuration file and a host firewall rule be present on every Amazon EC2 managed node in an account, including nodes that Auto Scaling launches later in the day. If an engineer changes either one on a node, the change must be corrected within an hour, and auditors need per-node evidence showing whether each node currently matches the required state. The company does not want to install a new configuration management agent.
What should the team implement?
Show answer and explanation
Answer:
State Manager "automates the process of keeping your managed nodes and other AWS resources in a state that you define," and an association "defines the state that you want to maintain on your resources... For example, an association can specify that antivirus software must be installed and running on a managed node, or that certain ports must be closed." An association "specifies a schedule for when to apply the configuration and the targets," and State Manager supports "targeting AWS resources by using tags," so an hourly, tag-targeted association re-applies the required state within the window and automatically covers nodes launched after it was created. Association compliance gives the auditors a per-node status, and it runs through SSM Agent, so no new agent is introduced.
Option A fixes the starting state only. The moment an engineer edits the file on a running node, it stays wrong until that node is replaced, up to a month later, not within an hour.
Option B is a one-time invocation on a schedule, not a maintained state. Nightly misses the one-hour requirement by a wide margin, and a Run Command invocation produces command output rather than the ongoing per-node compliance record the auditors want.
Option D cannot see what it needs to evaluate. AWS Config evaluates the *configuration of AWS resources*; the contents of a file and a firewall rule inside the guest operating system are not part of the EC2 instance's recorded configuration, so a custom rule has nothing to check.
Reference: AWS Systems Manager State Manager