A SaaS provider operates 120 Amazon Linux and Windows EC2 instances in Auto Scaling groups across two Regions. Leadership requires automated patch installation without disrupting releases, standardized patch approvals, and continuous validation for SOC 2 reporting. Which automated patching design should the engineer deploy to maintain compliant compute images with continuous validation?

The correct design succeeds because Patch Manager provides centralized automated installation for heterogeneous fleets, patch baselines define standardized approval rules for Amazon Linux and Windows across both Regions, maintenance windows coordinate installation and reboots with Auto Scaling to avoid disrupting releases, and Inspector supplies independent continuous validation of missing patches and CVEs for SOC 2 evidence. The Patch Manager design with baselines and scheduled windows automates multi-OS and multi-Region updates while protecting releases but provides no independent continuous vulnerability assessment, so compliance depends only on patch job history rather than validated exposure. The Patch Manager plus Inspector design with on-demand manual patching and no scheduled maintenance windows validates findings continuously but does not automate installation or coordinate reboots around releases, so patching depends on operators and can disrupt deployments. The Image Builder pipelines plus Inspector design standardizes new images and validates image vulnerabilities but does not patch the 120 existing running instances in Auto Scaling groups, leaving fleet drift until replacement and failing the fleet automation mandate. On exams, distinguish fleet patching from image building and distinguish approval policy from deployment scheduling and from detection, since scenarios deliberately test baselines versus windows versus Inspector. In practice, verify State Manager associations, per-OS baseline approval rules, window targets with rate concurrency and reboot controls, and Inspector findings aggregated for SOC 2 reporting.