SOA-C02 Deployment, Provisioning, and Automation Practice Question
An organization uses AWS Systems Manager to manage a fleet of EC2 instances. The SysOps administrator needs to run a script on all instances that have a specific tag (Environment: Production). The script must be executed immediately and only once. Which approach should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Run Command with a target based on the tag.
Run Command enables you to run commands on EC2 instances immediately and only once, using tags to target specific instances. Option A is incorrect because Patch Manager is designed for applying patches, not running arbitrary scripts. Option B is incorrect because Automation documents are for multi-step workflow orchestration, not simple one-time script execution. Option D is incorrect because State Manager is for recurring configurations or ensuring a desired state over time, not immediate one-time execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Patch Manager to apply the script as a patch baseline.
Why it's wrong here
Patch Manager relies on patch baselines that define approved and rejected patch sets for operating systems, such as Windows updates or Amazon Linux packages, and then uses the AWS-RunPatchBaseline document to scan or install them. Custom scripts are not a valid artifact type for a patch baseline, and Patch Manager has no mechanism to inject arbitrary code into the patching process. Therefore, treating it as a script runner is a category error; Run Command is the appropriate tool.
- ✗
Create an Automation document and execute it.
Why it's wrong here
Automation documents (ssm:Automation) are built for multi-step workflows, not simple one-shot script execution. Invoking one requires designing a YAML/JSON document, specifying parameters, and often an AutomationAssumeRole for cross-AWS API calls; even a single aws:runCommand step inside adds unnecessary overhead. Run Command directly executes a script on tagged targets with far less complexity and no need for a custom automation blueprint.
- ✓
Use Run Command with a target based on the tag.
Why this is correct
Run Command's SendCommand API accepts a target that can be a tag key-value pair, like tag:Environment=Production, and every SSM agent that matches will execute the AWS-RunShellScript or AWS-RunPowerShellScript document immediately in a one-time, unmanaged fashion. This satisfies the requirement of running a script once across the fleet, with output optionally streamed to S3 or CloudWatch Logs for auditing. Because no association, schedule, or patch baseline is involved, it is the simplest and most direct SSM primitive for this task.
- ✗
Create a State Manager association with the script.
Why it's wrong here
A State Manager association is a persistent configuration assignment; once created, it re-runs the script on the specified recurring schedule (e.g., cron or rate) and actively tracks compliance with the desired state. For a single immediate run, this would cause unintended repeated executions and require a separate association deletion step to stop it. Run Command is ephemeral: it executes once, returns output, and leaves no lifecycle behind, making it the correct choice over State Manager for a one-time script.
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.