DOP-C02 Configuration Management and IaC Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use AWS Systems Manager Automation to create a runbook that patches instances one by one.

  Why it's wrong here

  AWS Systems Manager Automation runbooks execute predefined or custom operational workflows, but their native step library does not include high-level 'patch this instance' primitives that respect patch baselines, reboot options, and maintenance windows the way Patch Manager does. Building a runbook to patch 'one by one' would require wrapping a patch invocation step, yet Automation lacks built-in scheduling or approval-gating semantics, so it is not the correct service for scalable, test-before-produce patch rollout.

• ✗

  Create a patch baseline and assign it to all instances; enable automatic approval for all patches.

  Why it's wrong here

  Assigning a patch baseline with automatic approval for all patches to every instance enables immediate deployment of any approved patch to production without a separation between test and production environments. This removes the testing gate, so a defective patch could reach all production instances in the first maintenance window, causing fleet-wide impact. The correct approach must delay production approval until patches have been validated in a test fleet, not approve everything globally.

• ✗

  Use AWS Systems Manager Run Command to manually run patch commands on test instances, then on production.

  Why it's wrong here

  Run Command lets you execute a command, such as aws:runPatchBaseline, on your chosen targets, but you would have to trigger it manually on test instances, wait, evaluate results, and then manually trigger it again on production instances. This approach has no centralized schedule, no automatic approval workflow, and no enforcement of maintenance windows, so it is not an automated, repeatable patching strategy. It also leaves room for human error, such as forgetting to wait for test validation before touching production.

• ✓

  Use AWS Systems Manager Patch Manager with maintenance windows, and configure a patch baseline that approves patches after a test period.

  Why this is correct

  Patch Manager automates the entire patching process by using a patch baseline to define which patches are approved, when they are approved (e.g., after a test period expressed in days), and how those rules are applied to tagged instance groups. Maintenance windows schedule when the patching runs on test and production fleets, ensuring production patches are installed only after the baseline's approval delay lets the test fleet validate them. This combination provides automation, a testing gate, and controlled rollout windows, which directly satisfies the requirement.

Go deeper

Related to this question