DOP-C02 SDLC Automation Practice Question
A company uses AWS Systems Manager Automation to patch EC2 instances. The automation document 'AWS-RunPatchBaseline' runs successfully but some instances are not patched because they are not managed by Systems Manager. What is the most likely reason?
⚠ Common exam trap
Many candidates assume patching failures are due to network connectivity or OS compatibility, when the root cause is almost always the missing SSM Agent or missing IAM role that prevents the instance from being managed by Systems Manager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The instances do not have the AWS Systems Manager Agent (SSM Agent) installed and the required IAM role attached.
Systems Manager Automation can only patch instances that are managed by Systems Manager. For an instance to be managed, it must have the SSM Agent installed and running, and it must have an IAM role that grants the necessary permissions (e.g., AmazonSSMManagedInstanceCore) to communicate with the Systems Manager service. Without these prerequisites, the instance is not registered as a managed node, so the automation document cannot target or patch it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The instances are running Windows Server 2012 or older.
Why it's wrong here
Windows Server 2012 is not inherently unsupported by Systems Manager; the SSM Agent can be installed on Windows Server 2008 R2 and later, so an older OS version alone does not prevent patching. The automation would still run as long as the agent is installed and the instance has the required IAM role. Thus, the OS version is not the reason for the patching failure.
- ✗
The instances are in a VPC without internet access.
Why it's wrong here
Communicating with Systems Manager does not require direct internet access; customers can use interface VPC endpoints for Systems Manager, Amazon EC2 messages, and Amazon Simple Storage Service (S3) to deliver patch content privately. The SSM Agent can also use an HTTP proxy if needed. Since private connectivity options exist, a VPC without internet access is not the cause of the patching failure.
- ✓
The instances do not have the AWS Systems Manager Agent (SSM Agent) installed and the required IAM role attached.
Why this is correct
The SSM Agent is the software component that executes Systems Manager requests on the instance, and the instance must also have an instance profile with IAM permissions to call Systems Manager APIs and download patch content. Without the agent or a role such as AmazonSSMManagedInstanceCore, the instance will not show up as a managed node and the automation cannot even target or initiate patching. This is the definitive prerequisite that is missing in this scenario.
- ✗
The automation document is not compatible with the instance's operating system.
Why it's wrong here
The AWS-RunPatchBaseline automation document is OS-agnostic and is designed to patch Amazon Linux, Red Hat, SUSE, Ubuntu, and Windows Server platforms; it invokes the appropriate patching logic based on the detected platform. While an incompatible document could cause an execution failure, the standard patching document covers widely used operating systems. Therefore, document incompatibility is not the reason the patching fails unless the OS is truly unsupported, which is not implied here.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.