The correct choices are Use the AWS-RunPatchBaseline SSM document to enforce approved patch baselines across the fleet and Install the AWS Systems Manager Agent on every instance, validate patches in staging, then schedule patching through Systems Manager Maintenance Windows with approvals.

Using Use the AWS-RunPatchBaseline SSM document to enforce approved patch baselines across the fleet gives a centralized Patch Manager workflow that supports both Windows and common Linux distributions and provides reporting and compliance checks. Pairing that with Install the AWS Systems Manager Agent on every instance, validate patches in staging, then schedule patching through Systems Manager Maintenance Windows with approvals enables staged rollouts, approval gates, and audit trails while keeping operational effort low.

Enable CloudFormation to automatically patch operating systems for all stacks and rely on AWS Config for audit reporting is incorrect because CloudFormation manages infrastructure as code and does not perform operating system patching and AWS Config can record configuration state but it does not orchestrate patch application.

Standardize on native OS package managers and approval workflows on each host, with AWS Config for compliance checks is not ideal because this approach requires custom automation and per host workflows that increase ongoing operational overhead compared with a centralized Systems Manager solution.

Use the AWS-ApplyPatchBaseline SSM document to patch Windows and Linux instances from the same baseline is incorrect because it does not provide the same cross platform, centralized patch baseline execution as Use the AWS-RunPatchBaseline SSM document to enforce approved patch baselines across the fleet and so it is not the right choice for a mixed Windows and Linux fleet.

Full AWS Practitioner Certification Question