The correct option is Define two distinct patch groups with unique tags for the Windows fleet, associate each to AWS-DefaultPatchBaseline, create two non-overlapping Systems Manager maintenance windows targeted by those patch group tags, and schedule AWS-RunPatchBaseline in each window with different start times. This approach staggers patching and reboots so that only part of the fleet is updated at any one time while the approved baseline is applied.

Using patch groups together with Patch Manager and Maintenance Windows lets you map subsets of instances to a baseline and to controlled schedules. Maintenance Windows provide built in targeting and timing so you can set non overlapping start times and avoid simultaneous reboots. Scheduling the AWS-RunPatchBaseline document in each window applies the AWS-DefaultPatchBaseline automatically and produces compliance reporting to verify the approved baseline is enforced.

Create one patch group tagged on all Windows instances, associate AWS-DefaultPatchBaseline, configure a single Systems Manager maintenance window, and run AWS-RunPatchBaseline during that window is wrong because a single shared window risks patching and rebooting the entire fleet at once and it does not provide the staggered reboots needed to maintain availability.

Configure two patch groups with unique tags mapped to all Windows instances, attach AWS-DefaultPatchBaseline to both, use EventBridge rules to trigger Systems Manager Run Command with a cron schedule, and manage custom steps with State Manager during execution is wrong because EventBridge and Run Command add unnecessary complexity for scheduling patch baselines and do not replace the built in scheduling and targeting features of Maintenance Windows that are designed for safe patch orchestration.

Use AWS Systems Manager Distributor to push Windows updates to instances on demand and rely on Auto Scaling rolling updates to stagger reboots across the fleet is wrong because Distributor is intended for distributing software packages and is not the supported mechanism for Windows OS patching and Auto Scaling rolling updates do not coordinate Patch Manager operations or baselines for a static EC2 fleet.

Full AWS Practitioner Certification Question