CLF-C02 Cloud Technology and Services Practice Question
A company runs a large fleet of Amazon EC2 instances across multiple environments (development, test, production). The security team requires a centralized, automated solution to apply operating system security patches on a regular schedule (e.g., every Tuesday at 2 AM). The solution must generate compliance reports showing which instances are patched and which are missing patches. The company wants a managed AWS service that works without requiring SSH or RDP access to the instances and does not require installing any custom agents. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
Many candidates confuse Amazon Inspector (which detects missing patches) with Patch Manager (which applies them), or assume AWS Config can enforce patching when it only evaluates configuration rules, not execute operational actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager Patch Manager
AWS Systems Manager Patch Manager is a managed service that automates the process of patching managed nodes with both security-related and other types of updates. It can be configured to run on a schedule (e.g., every Tuesday at 2 AM) using a Systems Manager maintenance window, and it generates compliance reports via Systems Manager Inventory and Compliance. Patch Manager works without requiring SSH or RDP access because it uses the AWS Systems Manager Agent (SSM Agent), which is pre-installed on many Amazon EC2 AMIs and can be installed without interactive logon, and it does not require custom agents beyond the SSM Agent itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Systems Manager Patch Manager
Why this is correct
Correct. AWS Systems Manager Patch Manager automates the process of patching managed nodes with both security-related and other types of updates. It uses the SSM Agent, which is preinstalled on many EC2 AMIs, to run patch scans and installations according to a schedule you define. Compliance reports are available directly in the AWS Systems Manager console.
- ✗
AWS Config
Why it's wrong here
Incorrect. AWS Config is a service that evaluates your AWS resource configurations against desired policies and tracks configuration changes over time. It does not have the ability to install patches or manage patching schedules. It can only report on whether an EC2 instance is compliant with a rule that checks, for example, whether patches are installed, but it cannot perform the patching itself.
When this WOULD be correct
A company needs to continuously monitor and record EC2 instance configurations (e.g., security group rules, AMI IDs) and receive alerts when configurations deviate from desired policies. AWS Config would be the correct service to track configuration changes and evaluate compliance with rules.
- ✗
Amazon Inspector
Why it's wrong here
Incorrect. Amazon Inspector is an automated vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It discovers vulnerabilities but does not apply patches. It provides a report of findings and recommendations, but the actual remediation (patching) must be done by another service or manually.
When this WOULD be correct
A company needs to automatically assess EC2 instances for common vulnerabilities and exposures (CVEs) and generate a report of findings, without applying patches. The solution must be a managed service that works with Systems Manager to install an agent for deep inspection.
- ✗
AWS OpsWorks
Why it's wrong here
Incorrect. AWS OpsWorks is a configuration management service that uses Chef or Puppet to manage configurations on EC2 instances. While it can be used to apply patches as part of a cookbook or module, it is not specifically designed for automated patching on a schedule with built-in compliance reporting. It requires more custom scripting and setup compared to Patch Manager. Also, OpsWorks typically requires the Chef or Puppet agent, which is not preinstalled on standard AMIs.
When this WOULD be correct
A company needs to manage application configurations and automate server setups using Chef or Puppet across a fleet of EC2 instances, and is already using OpsWorks for lifecycle management, with patching handled as part of custom recipes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Systems Manager Patch ManagerCorrect answer▾
Why this is correct
Correct. AWS Systems Manager Patch Manager automates the process of patching managed nodes with both security-related and other types of updates. It uses the SSM Agent, which is preinstalled on many EC2 AMIs, to run patch scans and installations according to a schedule you define. Compliance reports are available directly in the AWS Systems Manager console.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config is a service for evaluating resource configurations against rules, not for applying patches or scheduling patch operations. It cannot automate the installation of OS patches or generate patch compliance reports without additional services.
★ When this WOULD be the correct answer
A company needs to continuously monitor and record EC2 instance configurations (e.g., security group rules, AMI IDs) and receive alerts when configurations deviate from desired policies. AWS Config would be the correct service to track configuration changes and evaluate compliance with rules.
Why candidates choose this
Candidates may confuse AWS Config's compliance evaluation with patch compliance reporting, or think that Config can enforce patching because it can trigger remediation actions via Systems Manager Automation, but the core requirement is automated patching, not just configuration monitoring.
✗Amazon InspectorWrong answer — click to see why▾
Why this is wrong here
Amazon Inspector is a vulnerability assessment service that scans for software vulnerabilities and unintended network exposure, but it does not apply patches or manage patch schedules. It also requires an agent (AWS Systems Manager Agent) for deeper host assessments, contradicting the 'no custom agents' requirement.
★ When this WOULD be the correct answer
A company needs to automatically assess EC2 instances for common vulnerabilities and exposures (CVEs) and generate a report of findings, without applying patches. The solution must be a managed service that works with Systems Manager to install an agent for deep inspection.
Why candidates choose this
Candidates may confuse vulnerability scanning (Inspector) with patch management (Patch Manager), as both involve security compliance and can generate reports. The 'no custom agents' phrase might mislead them into thinking Inspector's agentless network assessment is sufficient, ignoring the patch application requirement.
✗AWS OpsWorksWrong answer — click to see why▾
Why this is wrong here
AWS OpsWorks is a configuration management service that uses Chef or Puppet, requiring agents on instances and SSH/RDP access, and does not provide native patch compliance reporting or scheduled patching without custom recipes.
★ When this WOULD be the correct answer
A company needs to manage application configurations and automate server setups using Chef or Puppet across a fleet of EC2 instances, and is already using OpsWorks for lifecycle management, with patching handled as part of custom recipes.
Why candidates choose this
Candidates may associate OpsWorks with automation and management of EC2 instances, mistakenly thinking it includes patch management, without realizing it requires agents and does not offer built-in patch compliance reporting.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.