Courseiva
← PAS-C01
Full test
Operations and Maintenance →mediumMultiple ChoiceObjective-mapped

PAS-C01 Operations and Maintenance Practice Question

Exhibit

Refer to the exhibit.

"Resources:
  SAPApplicationServer:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType
      SecurityGroupIds:
        - !Ref AppSecurityGroup
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
      Tags:
        - Key: Name
          Value: SAP-APP-Server
  AppSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for SAP application servers
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0"

Refer to the exhibit. An SAP administrator uses the CloudFormation template snippet to create an application server. After deployment, the administrator cannot connect to the instance using AWS Systems Manager Session Manager. What is the most likely missing configuration?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The instance does not have an IAM instance profile with Systems Manager permissions

Session Manager requires the SSM Agent and an IAM role with proper permissions. The template installs the agent via UserData, but it does not attach an IAM instance profile. Without the profile, the instance cannot authenticate to Systems Manager. The security group allows HTTPS inbound, but that is for web traffic, not SSM. The instance type is fine.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The UserData script fails to install the SSM Agent

    Why it's wrong here

    The script looks correct; even if agent fails, the missing IAM role would still block access.

  • ✓

    The instance does not have an IAM instance profile with Systems Manager permissions

    Why this is correct

    An IAM role with AmazonSSMManagedInstanceCore policy is required for Session Manager.

  • ✗

    The security group does not allow outbound traffic to the Systems Manager endpoint

    Why it's wrong here

    Session Manager typically uses VPC endpoints or internet, but the missing IAM role is the primary issue.

  • ✗

    The instance type does not support Systems Manager

    Why it's wrong here

    All EC2 instance types support Systems Manager.

About these practice questions

This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.