Ops must keep hundreds of EC2 instances patched to an approved baseline on a schedule, with reports on compliance. Which Systems Manager capability is designed for this?
A.Session Manager
Session Manager is interactive shell access, not patching.
B.Patch Manager with patch baselines and maintenance windows
Correct. Baselines + windows + compliance = Patch Manager's job.
C.Run Command with ad-hoc yum commands
Ad-hoc commands aren't scheduled, baseline-aware patching.
D.AWS Config rules
Config audits configuration, doesn't install patches.
Why this answer
Patch Manager combines patch baselines (approved patch sets) + maintenance windows (scheduled install) + compliance reporting — the complete fleet-patching answer. Run Command executes commands but doesn't manage patch state.
Correct answer: B · Last reviewed 2026-10-28
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Operations practice session.
Practice Security Operations