Municipal policy requires critical OS and package patches on EC2 fleets within 30 days. Which approach best operationalizes that standard for a new solution?
Select an answer to reveal the explanation.
Short Explanation
Systems Manager Patch Manager is the city work-order system for EC2—scheduled windows, known baselines, receipts that criticals landed inside 30 days. Hope-and-pray manual patching is not a standard.
Full Explanation
Municipal policy requiring critical OS and package patches within 30 days needs inventory, baselines, and proof—not ad-hoc SSH. AWS Systems Manager Patch Manager with inventories, patch baselines, and maintenance windows operationalizes that standard for new EC2 fleets and produces compliance reporting. Allowing each team to patch manually whenever convenient without inventory fails the 30-day evidence requirement. Never patching production because change windows are risky accumulates vulnerability exposure. Rebuilding AMIs only once per year regardless of critical CVEs misses the SLA for newly disclosed issues. Exam caveat: Patch Manager still depends on SSM agent health, instance profiles, and change calendars aligned to civic operations. Operational check: enroll a pilot fleet, associate a critical baseline with a 30-day compliance goal, run scan and install in a maintenance window, and export compliance results for the city's patch report. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure.