CLF-C02 Cloud Technology and Services Practice Question
A company uses AWS Organizations to manage multiple accounts. The operations team runs hundreds of Amazon EC2 instances across these accounts for various applications. The security team requires that all EC2 instances be patched with the latest security updates within 7 days of release. Currently, the operations team manually applies patches by logging into each account and using Systems Manager Patch Manager individually. The team wants to centralize patch compliance management so that a single operations team can define patch baselines, schedule patching, and view compliance status across all accounts from a single pane of glass, without needing to switch between accounts. Which AWS service or feature should the team use to meet these requirements?
⚠ Common exam trap
Many exam-takers confuse Amazon Inspector's vulnerability scanning with actual patch management, but Inspector only identifies vulnerabilities and does not apply patches, whereas Patch Manager is the service designed for centralized patching and compliance reporting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager Patch Manager
AWS Systems Manager Patch Manager is the correct choice because it allows the operations team to centrally define patch baselines, schedule patching across multiple AWS accounts, and view compliance status from a single pane of glass using AWS Systems Manager Quick Setup or multi-account management features. By integrating with AWS Organizations, Patch Manager can target EC2 instances across all accounts without requiring the team to switch between accounts, meeting the requirement for centralized patch compliance management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config is a service that records and evaluates the configuration of AWS resources against desired policies, providing a timeline of configuration changes and compliance status. It can detect when an EC2 instance is missing a required patch or is out of compliance with a patching policy, but it cannot schedule, execute, or automate the installation of patches. To actually remediate non-compliant resources, you would need to pair AWS Config with other services like AWS Systems Manager, making it a monitoring tool rather than a patch management solution.
When this WOULD be correct
A company needs to continuously monitor and record EC2 instance configurations, detect drift from desired baseline configurations, and trigger remediation actions (e.g., via Lambda) when instances become non-compliant with patching rules.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that performs automated security assessments by scanning workloads for software vulnerabilities and unintended network exposure. Its findings may include missing patches or known CVEs, but it only identifies these issues; it does not apply patches or offer a mechanism to schedule patching operations. Amazon Inspector role is to detect and report vulnerabilities, leaving the remediation, including patch installation, to separate systems like AWS Systems Manager Patch Manager.
When this WOULD be correct
A company needs to automatically assess EC2 instances for missing security patches and software vulnerabilities across multiple accounts, and generate a consolidated findings report. The security team wants to identify which instances are non-compliant with patch policies, but the actual patching is handled by a separate process.
- ✓
AWS Systems Manager Patch Manager
Why this is correct
AWS Systems Manager Patch Manager automates the process of patching managed instances. With cross-account support via AWS Organizations and IAM roles, it allows you to define a single patch baseline, schedule patching across multiple accounts, and view aggregated compliance status in the Systems Manager console.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is an advisory service that reviews your AWS environment against best practices in categories such as cost optimization, security, fault tolerance, and performance. It provides recommendations like whether an EC2 instance is underutilized or if security groups are too permissive, but it does not manage or patch operating systems. Trusted Advisor offers checks and guidance, not the operational capability to deploy patches or establish a patching schedule across accounts.
When this WOULD be correct
A company wants to receive security recommendations and check for common misconfigurations across their AWS environment, such as overly permissive security groups or unused resources, and wants a single dashboard to view these findings for multiple accounts using AWS Organizations.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Systems Manager Patch ManagerCorrect answer▾
Why this is correct
AWS Systems Manager Patch Manager automates the process of patching managed instances. With cross-account support via AWS Organizations and IAM roles, it allows you to define a single patch baseline, schedule patching across multiple accounts, and view aggregated compliance status in the Systems Manager console.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config evaluates resource compliance against rules but does not provide patch management, scheduling, or centralized patch compliance dashboards across accounts.
★ When this WOULD be the correct answer
A company needs to continuously monitor and record EC2 instance configurations, detect drift from desired baseline configurations, and trigger remediation actions (e.g., via Lambda) when instances become non-compliant with patching rules.
Why candidates choose this
Candidates may confuse AWS Config's compliance evaluation capabilities with patch management, assuming it can handle patching workflows when it only assesses configuration state.
✗Amazon InspectorWrong answer — click to see why▾
Why this is wrong here
Amazon Inspector is a vulnerability assessment service that scans for software vulnerabilities and unintended network exposure, but it does not provide patch management, scheduling, or centralized compliance dashboards across multiple accounts. The question requires defining baselines, scheduling patching, and viewing compliance status, which are capabilities of Systems Manager Patch Manager, not Inspector.
★ When this WOULD be the correct answer
A company needs to automatically assess EC2 instances for missing security patches and software vulnerabilities across multiple accounts, and generate a consolidated findings report. The security team wants to identify which instances are non-compliant with patch policies, but the actual patching is handled by a separate process.
Why candidates choose this
Candidates may confuse Amazon Inspector's vulnerability scanning with patch compliance management, assuming that detecting missing patches implies the ability to schedule and apply them. They might also think Inspector's multi-account support provides the centralized view required.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides best-practice recommendations for cost optimization, performance, security, and fault tolerance, but it does not offer the ability to define patch baselines, schedule patching, or view patch compliance status across multiple accounts from a single pane of glass.
★ When this WOULD be the correct answer
A company wants to receive security recommendations and check for common misconfigurations across their AWS environment, such as overly permissive security groups or unused resources, and wants a single dashboard to view these findings for multiple accounts using AWS Organizations.
Why candidates choose this
Trusted Advisor is associated with security checks and best practices, so candidates may mistakenly believe it can manage patching, especially when the requirement mentions 'compliance status' and 'single pane of glass'.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company manages a fleet of hundreds of Amazon EC2 instances running across multiple AWS Regions. The company's security policy requires that all instances be patched with the latest security updates within 7 days of release. The operations team currently logs in to each instance manually to apply patches, which is time-consuming and error-prone. The team wants to automate the patching process, track compliance across all instances, and receive reports on patch status. The solution must not require any changes to the existing application code or the use of additional third-party software. Which AWS service should the operations team use to meet these requirements?
medium- A.AWS Config
- ✓ B.AWS Systems Manager
- C.Amazon Inspector
- D.AWS Trusted Advisor
Why B: AWS Systems Manager is the correct choice because it provides Patch Manager, a native capability that automates the patching of EC2 instances across multiple Regions without requiring any changes to application code or third-party software. It also integrates with Systems Manager Compliance to track patch status and generate reports, meeting all stated requirements.
Variation 2. A company runs a large fleet of Amazon EC2 instances across multiple environments (development, test, production). The security team requires a centralized, automated solution to apply operating system security patches on a regular schedule (e.g., every Tuesday at 2 AM). The solution must generate compliance reports showing which instances are patched and which are missing patches. The company wants a managed AWS service that works without requiring SSH or RDP access to the instances and does not require installing any custom agents. Which AWS service should the company use to meet these requirements?
medium- ✓ A.AWS Systems Manager Patch Manager
- B.AWS Config
- C.Amazon Inspector
- D.AWS OpsWorks
Why A: AWS Systems Manager Patch Manager is a managed service that automates the process of patching managed nodes with both security-related and other types of updates. It can be configured to run on a schedule (e.g., every Tuesday at 2 AM) using a Systems Manager maintenance window, and it generates compliance reports via Systems Manager Inventory and Compliance. Patch Manager works without requiring SSH or RDP access because it uses the AWS Systems Manager Agent (SSM Agent), which is pre-installed on many Amazon EC2 AMIs and can be installed without interactive logon, and it does not require custom agents beyond the SSM Agent itself.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.