Fleet of 500 instances must be patched weekly on Sundays 2–4 AM, only installing approved security patches, with compliance reporting. Which SSM feature combination?
A.Patch Manager baseline + maintenance window + Compliance dashboard
Baseline + schedule + compliance = the managed patching answer. Correct.
B.User-data script with cron yum update
Cron in user data is unmanaged — no central compliance view.
C.Run Command once with a patch-all script
One-off Run Command lacks scheduling, baselines, and reporting.
D.Systems Manager Inventory only
Inventory is read-only — it reports, doesn't patch.
Why this answer
The full patching stack: patch baseline (approved patches/rules) + maintenance window (schedule, targets, rate control) + Compliance reporting (who's missing patches). Inventory collects software data but doesn't patch.
Correct answer: A · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Deployment & Automation practice session.
Practice Deployment & Automation