Get Your CertSAP-C02PlayCompete
‹ All SAP-C02 questions

SAP-C02 Practice Question 58: Fleet Patch Compliance

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 6 · question 8 of 10

Continuous Improvementmedium

An auditor has given a logistics company three requirements for its 4,000 EC2 instances (a mix of Windows Server and several Linux distributions) spread over 60 accounts in four Regions. Security classified operating system patches must be installed monthly inside a defined maintenance window. The company must be able to produce evidence, per instance, of which required patches are installed and which are missing. And two specific vendor updates that are known to break a warehouse application must never be installed.

Many of the instances run stateful legacy software and cannot simply be replaced with freshly baked images. The operations team is small and wants one configuration rather than per-account work.

What should the solutions architect implement?

Select one answer
Show answer and explanation

Answer:

  • C. Define custom Patch Manager patch baselines per operating system that approve security classifications and explicitly reject the two problem updates, run scan-and-install on a schedule through a Quick Setup patch policy across the organization, and generate patch compliance reports

Patch Manager addresses all three auditor requirements with one configuration. A patch baseline defines what compliance means: you can approve all patches of a given classification and severity (here, Security), and you can reject specific updates by ID, which is how the two application-breaking vendor updates are permanently excluded. Patching itself can be a Scan operation that only reports missing patches or a Scan and install operation that installs them, run on a schedule. For the multi-account requirement, AWS names patch policies in Quick Setup as the recommended method and states that a single patch policy configuration can define patching for all accounts in all Regions in an organization. Compliance reporting closes the loop: after a scan you can see which managed nodes are out of compliance and which patches are missing, and generate reports in CSV to an S3 bucket on a schedule, the per-instance evidence the auditor wants. Patch Manager supports Windows Server and multiple Linux distributions, and it patches in place, which the stateful legacy instances require.

Option A is the immutable-infrastructure approach, and it is a good pattern where it fits, but the stem says many instances are stateful and cannot be replaced, and rebuilding images monthly for several operating systems gives no per-instance compliance evidence and no mechanism for rejecting an individual update.

Option B installs patches but proves nothing. There is no baseline, so there is no definition of compliance and no report of what is missing, and a blanket update command would install the two updates that break the warehouse application.

Option D is detection, not remediation. Amazon Inspector is valuable for finding vulnerabilities, but it does not install patches, does not enforce a maintenance window, and does not produce patch compliance against an approved baseline.

Reference: AWS Systems Manager Patch Manager

Practice Test 6 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.
AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.
IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.
VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.