DOP-C02 Security and Compliance Practice Question
A company wants to automate patching of EC2 instances running Amazon Linux 2 while ensuring compliance with security policies. Which AWS service should be used?
⚠ Common exam trap
Candidates often confuse Amazon Inspector (which finds vulnerabilities) with Patch Manager (which fixes them), or assume AWS Config can remediate patches directly, when in reality Config only evaluates compliance and requires a separate automation action (e.g., via Systems Manager Automation) to apply patches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager Patch Manager
AWS Systems Manager Patch Manager automates the patching of EC2 instances, including Amazon Linux 2, by using patch baselines to define approved patches and compliance rules. It integrates with maintenance windows and State Manager to schedule and enforce patching, ensuring instances remain compliant with security policies without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is a support tool that performs automated checks against your AWS environment across categories like cost, performance, security, and fault tolerance, then provides actionable recommendations. It neither applies patches nor orchestrates patch installation; its role is limited to advisory insight and best-practice guidance. Therefore, while it might highlight a security risk, you would still need a dedicated service such as Patch Manager to actually remediate it.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management and network traffic inspection service that evaluates your EC2 instances for software vulnerabilities and unintended network exposure. It produces detailed findings, including missing patches, based on its built-in knowledge base or custom rules, but it does not install or distribute updates itself. Inspector typically surfaces findings whose remediation would require a separate patching engine, making it a detection tool, not an automation tool.
- ✗
AWS Config
Why it's wrong here
AWS Config provides configuration recording, the ability to evaluate resource compliance against desired conditions, and can trigger automated remediation using custom or SSM automation documents. However, patching is not a native AWS Config operation; you would have to define the compliance rule and hook it to a Systems Manager document or maintenance window to perform the actual patch. Thus, AWS Config serves as a governance layer that can detect patch drift but does not directly manage patch installation.
- ✓
AWS Systems Manager Patch Manager
Why this is correct
AWS Systems Manager Patch Manager is a purpose-built capability that automates the process of patching managed instances, whether they are EC2 instances or on-premises servers. It works in tandem with patch baselines, maintenance windows, and rate control to approve, schedule, and install patches, and it also reports patch compliance for the fleet. With the SSM Agent installed, Patch Manager uses a standard SSM document such as AWS-RunPatchBaseline to execute the patch operation, making it the correct choice for automated OS patching.
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.