A company runs 500 Amazon EC2 instances and container hosts across production that miss patches, causing audit failures. Maintenance cannot cause downtime and must validate fixes continuously. Which patch deployment approach should the team implement to automate updates with continuous validation across compute?

The correct automated Patch Manager baselines with maintenance windows plus continuous Inspector and Config validation succeeds because version-controlled baselines automate approval and deployment across 500 instances, windows with rolling concurrency and reboot controls prevent downtime, while Inspector gives continuous vulnerability assessment for EC2 and container workloads and Config rules give continuous compliance recording for audits. The reboot-all-production-at-once windows approach fails on safety by concept because simultaneous reboots violate no-downtime and post-deployment verification alone misses continuous validation. The baselines-with-monthly-post-window-check approach fails on frequency by concept because periodic checks leave drift undetected and cannot satisfy continuous validation. The Inspector-and-Config-detect-with-manual-operator-remediation approach fails on automation by concept because queuing findings for humans does not scale to hundreds of hosts and reintroduces delay that automation removes. Exam caveat: distinguish continuous evaluation from scheduled scans or post-window checks, as monthly or manual-trigger wording signals a missed constraint. Practical check: verify window concurrency and reboot settings, confirm Inspector coverage for EC2 and containers, and review the Config timeline to prove continuous enforcement.