Get Your CertDOP-C02PlayCompete
‹ All DOP-C02 questions

DOP-C02 Practice Question 24: Patch Compliance Maintenance Window

AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 3 · question 4 of 10

Configuration Management and IaCmedium

A regulated company runs 500 Amazon EC2 managed nodes. Auditors require a daily report of which approved patches are missing from every node. Change management forbids installing patches outside a Sunday 02:00–05:00 maintenance window, and forbids any reboot outside that window. The company already has custom patch baselines that define which patches are approved.

Which approach meets all of these requirements?

Select one answer
Show answer and explanation

Answer:

  • D. Create a maintenance window for Sunday 02:00–05:00 with a Run Command task that runs AWS-RunPatchBaseline with Operation=Install, and a separate daily State Manager association that runs AWS-RunPatchBaseline with Operation=Scan

AWS-RunPatchBaseline takes a required Operation parameter with two values, and they map cleanly onto the two requirements. Scan "determines the patch compliance state of the managed node and reports this information back to Patch Manager" and "doesn't prompt updates to be installed or managed nodes to be rebooted", safe to run every day, and it produces exactly the missing-patch data the auditors want. Install "attempts to install the approved and applicable updates that are missing" and reboots by default, so it belongs inside the approved maintenance window. Running the install task from a maintenance window also lets Patch Manager supply a consistent snapshot ID across the fleet.

Option A installs patches, and reboots nodes, every day at 02:00, violating both the change management rules the stem sets out.

Option B respects the window but only produces compliance data once a week, when the install task runs. On the other six days there is no fresh report, and an Install operation's compliance data does not list missing updates anyway.

Option C swaps in the wrong tools on both halves. Amazon Inspector reports software vulnerabilities against CVE data, not compliance against your Patch Manager baselines. AWS-InstallWindowsUpdates installs updates directly from Windows Update, bypassing the approval rules in the custom baselines, and it does not apply to Linux nodes at all.

Reference: SSM Command document for patching: AWS-RunPatchBaseline

Practice Test 3 ›

Study guides for DOP-C02

AWS Service Control Policies Explained: SCPs and DenialsAWS service control policies explained: how SCPs cap permissions, why admins still get access denied, inheritance, deny vs allow lists and the exam traps.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
What Is Amazon RDS? Multi-AZ, Read Replicas and BackupsWhat is Amazon RDS? Engines, Multi-AZ, read replicas, backups, RDS Proxy, Aurora and pricing explained, with the traps that AWS exams set around each one.
Best DevOps certification: AWS, Azure, Google or CKAThe best DevOps certification for your stack: AWS DOP-C02, Azure AZ-400, Google Cloud DevOps Engineer and CKA compared on cost, level and prerequisites.
What Is AWS Lambda? Triggers, Concurrency and Cold StartsWhat is AWS Lambda? How functions run, cold starts, triggers vs event source mappings, concurrency, layers, aliases, pricing and the exam traps.
AWS CloudOps Engineer Associate (SOA-C03) exam guideAWS Certified CloudOps Engineer – Associate (SOA-C03) replaced SysOps Administrator. Format, cost, the five domains, what changed and how to prepare.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is Amazon EC2? Instances, AMIs, EBS and Auto ScalingAmazon EC2 explained: instances, AMIs, instance types, security groups, EBS, Auto Scaling groups and pricing options, with the traps AWS exams set.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.