You just manually run the "AWS-RunPatchBaseline" command in AWS Systems Manager Run Command. The operation has identified dozens of EC2 instances that are out of compliance. Your manager asks you to patch these instances within 2 days. The patching must be done in a maintenance window. Which of the following options is the most appropriate?

Answer options:

A.SSH to these instances and use “yum update” to install the latest patches.
B.Use the “Patch now” option in AWS Patch Manager to patch the instances in a maintenance window.
C.In Patch Manager of AWS Systems Manager, create a patching configuration to install patches in a maintenance window.
D.In a maintenance window, run the same "AWS-RunPatchBaseline" command in AWS Systems Manager Run Command and select the Operation to be “Scan”.

Correct Answer: C
Option A is incorrect because the instances may be Windows servers; then, users cannot SSH to them or use the “yum update” command.
Option B is incorrect because although the “Patch now” option can update the compliance status of instances or install patches immediately, users cannot schedule a maintenance window in this option.
Option C is CORRECT because, in a patch configuration, you can specify a maintenance window and install the patches as the following snapshot:
Option D is incorrect because the Operation of the "AWS-RunPatchBaseline" command should be “Install” to install patches missing from the baseline.
Reference:
https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-compliance-remediate.html