An operations team must apply OS security patches to hundreds of EC2 instances on a schedule, with approval controls and compliance reporting. Which service handles this natively?
A.AWS Config
Config assesses configuration compliance; it doesn't apply patches.
B.AWS Systems Manager Patch Manager
Correct. Patch Manager is SSM's fleet patching capability.
C.Amazon Inspector
Inspector scans for vulnerabilities but doesn't remediate them.
D.AWS CloudFormation
CloudFormation provisions infrastructure, not OS patching cycles.
Why this answer
Systems Manager Patch Manager automates patching at fleet scale: patch baselines define approved updates, maintenance windows control scheduling, and compliance reporting shows patch status — purpose-built for this.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Deployment & Automation practice session.
Practice Deployment & Automation