DOP-C02 Configuration Management and IaC Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Ensure the SSM Agent is installed and running on the servers

  Why this is correct

  For a hybrid server to be managed by Systems Manager, the SSM Agent must be installed and actively running on the operating system. The agent is the on-premises component that establishes the communication channel with the Systems Manager service, handles requests for Run Command, Patch Manager, and Inventory, and reports the instance's status back to the service. If the agent is absent, stopped, or in an unhealthy state, the server will not appear in the inventory or compliance views, and no Systems Manager operation can target it. Reinstalling or restarting the agent, and periodically verifying its health, is the first-line remediation for 'missing' hybrid nodes.

• ✗

  Verify that the servers have the correct patch baseline tags

  Why it's wrong here

  Patch baseline tags are metadata used by Systems Manager to map managed nodes to the appropriate patch baseline during a patching operation. Even if the tags are missing or misconfigured, the server should still appear in the Fleet Manager or managed instance list because node discovery depends on the agent and registration with Systems Manager, not on the tags themselves. Incorrect baseline tags would cause the server to be patched with the wrong patch definitions or skipped during patching, but it would not make the server invisible. Therefore, checking tags is a relevant troubleshooting step when patching behavior is off, but it does not address the root cause of a server that is completely unreachable.

• ✗

  Check that the Patch Baseline is configured to include the missing servers

  Why it's wrong here

  The Patch Baseline configuration controls what patches are approved and how they are applied to targets; it does not control which managed nodes are registered or visible in Systems Manager. A patch baseline is applied to nodes through associations or tags, but node discovery and reporting are driven by the SSM Agent and the instance registration process. If the agent is not running, the server will not appear in Patch Manager compliance reports regardless of how the baseline is configured. Adjusting the baseline to 'include' the missing servers is an invalid action because baselines do not have a membership list—they are referenced by name or tag, and the server must already be a registered managed node to be eligible.

• ✗

  Confirm that the servers have an IAM service role for Systems Manager

  Why it's wrong here

  Hybrid servers managed by Systems Manager use an IAM service role (or an IAM instance profile in the case of EC2) to grant the SSM Agent permissions to call AWS APIs. If the IAM role is missing or lacks the required permissions, the agent may fail to register the server with the Systems Manager service, which can cause it to be absent from the console. However, for hybrid activations, the correct setup is an IAM service role that is attached to the hybrid activation, not an EC2 instance profile—and the question's note correctly points out that a 'service role' is needed for hybrid, while an instance profile is for EC2. The lack of an IAM role is a plausible secondary cause, but it is not the most direct and common cause: the SSM Agent must first be installed and running, and an agent that is not running will prevent registration even with perfect IAM permissions. So while verifying IAM is useful, it is not the immediate action that ensures the servers become visible.

Go deeper

Related to this question