DOP-C02 Configuration Management and IaC Practice Question
A company uses AWS Systems Manager to manage a fleet of EC2 instances. They need to run a script on all instances that have a specific tag 'Environment:Development'. Which Systems Manager capability should be used?
⚠ Common exam trap
It's easy for candidates to confuse Run Command with State Manager, as both can execute scripts, but State Manager is for recurring, state-enforcement tasks (using associations), not for immediate, tag-based ad-hoc execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run Command
Run Command is the correct capability because it allows you to remotely and securely execute scripts or commands on targeted EC2 instances using AWS Systems Manager. You can target instances by specifying tags, such as 'Environment:Development', and Run Command will execute the script on all matching instances without requiring SSH or RDP access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Inventory
Why it's wrong here
AWS Systems Manager Inventory collects metadata about managed instances, such as installed applications, network configuration, and operating system details. It is a discovery and reporting feature, not a command execution engine. Inventory does not run scripts or perform actions on demand, so it cannot execute a script based on tags.
- ✗
Patch Manager
Why it's wrong here
AWS Systems Manager Patch Manager automates the process of deploying security patches and updates to managed instances, using Patch Baselines and Maintenance Windows. It is designed for patch compliance, not for arbitrary script execution. Patch Manager applies updates according to schedules, never as an immediate one-off command targeting tags for a custom script.
- ✓
Run Command
Why this is correct
Run Command is the correct choice because it provides secure, on-demand remote execution of scripts and commands across EC2 instances, targeting tagged instances through AWS resource groups or tag key-value pairs. It uses SSM documents to define the script and the SSM Agent to execute it, with results streamed back to the console or S3. This directly matches the requirement to run a script on a fleet selected by tags.
- ✗
State Manager
Why it's wrong here
State Manager is used to define and maintain a desired state on instances by creating associations that run automatically on a schedule, such as ensuring a certain service is running or files are present. While it can run scripts in those associations, it is not an on-demand execution tool; it is a recurring, state-enforcement mechanism. Invoking a script right now based on a tag query is not the purpose of State Manager.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.