SAA-C03 Q298 · IAM

Question

A company has a non-production application that runs on an Amazon EC2 instance. The EC2 instance has an instance profile and an associated IAM role. The company wants to automate patching for the EC2 instance. Which solution will meet this requirement?

Accepted Answer

**Answer C** is correct because it follows the simplest, most appropriate path:

1. **The EC2 instance already has an instance profile and an associated IAM role.** There is no need to create a new role — you simply attach the required policy to the existing role.

2. **AmazonSSMManagedInstanceCore** is the AWS-managed policy that grants EC2 instances the minimum permissions needed to communicate with the AWS Systems Manager service. This includes permissions for `ssm:*`, `ssmmessages:*`, `ec2messages:*`, and related actions.

3. **AWS Systems Manager Patch Manager** is the purpose-built service for automating OS and application patching on EC2 instances. Once the instance can communicate with SSM (via the attached policy), you can define patch baselines, create maintenance windows, and au

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips