A healthcare provider runs Amazon EC2 fleets and container hosts across prod and staging. Compliance requires timely OS patches with maintenance windows, staged rollouts, and proof that hosts remain vulnerability-free. Which solution should the platform team deploy to patch compute and maintain continuous compliance?
Select an answer to reveal the explanation.
Short Explanation
You can't chase every server by hand — it's like weeding a football field with tweezers. You'll stay audit-ready when you schedule Patch Manager baselines in maintenance windows and prove you're clean with Inspector scans.
Full Explanation
The correct solution pairs scheduled Patch Manager baselines governed by maintenance windows for controlled, staged rollouts across prod and staging with Inspector scans for continuous validation that OS packages and container host software remain vulnerability-free, directly meeting timely patching, safe deployment, and auditable proof requirements for both EC2 fleets and container hosts. Applying default baselines across environments with Inspector validation is operationally common for keeping systems current, but it fails the controlled-change concept because without maintenance windows and phased rollout controls patches can reboot or disrupt production workloads outside approved times. Scheduling Patch Manager with windows and reviewing Compliance history is also standard practice for patch operations, yet it confuses patch compliance with vulnerability management since Compliance records that a defined baseline was applied while Inspector proves absence of CVEs, misconfigurations, and exposed paths, so auditors still lack proof of vulnerability-free state. Running Patch now on demand across every instance at once pairs well with Inspector validation, but it fails the controlled-rollout concept because it bypasses maintenance windows and staging-first sequencing, so production can be patched and rebooted outside approved times. On exams, distinguish patch-state reporting from vulnerability assessment and controlled rollout from merely enabling patching, watching for scope words like EC2, production, or containers. In practice, verify maintenance window targets include prod and staging EC2 and container instances, confirm Inspector is enabled for EC2 and container scanning, and retain both Patch Manager compliance and Inspector findings as compliance evidence.