Automating OS Patching and Vulnerability Scanning with AWS Systems Manager

SAA-C03 By islever Editorial Last updated

Design secure workloads and applications.

Short answer

B Use AWS Systems Manager Patch Manager for automated OS updates and Amazon Inspector for vulnerability scanning reports.

Question

A company has migrated a fleet of hundreds of on-premises virtual machines (VMs) to Amazon EC2 instances. The instances run a diverse fleet of Windows Server versions along with several Linux distributions. The company wants a solution that will automate inventory and updates of the operating systems. The company also needs a summary of common vulnerabilities of each instance for regular monthly reviews. What should a solutions architect recommend to meet these requirements?
  1. Set up AWS Systems Manager Patch Manager to manage all the EC2 instances. Configure AWS Security Hub to produce monthly reports.
  2. Set up AWS Systems Manager Patch Manager to manage all the EC2 instances. Deploy Amazon Inspector, and configure monthly reports. Correct Answer
  3. Set up AWS Shield Advanced, and configure monthly reports. Deploy AWS Config to automate patch installations on the EC2 instances.
  4. Set up Amazon GuardDuty in the account to monitor all EC2 instances. Deploy AWS Config to automate patch installations on the EC2 instances.

Key Takeaways

The question tests knowledge of specific AWS security services; the common trap is confusing vulnerability scanning (Inspector) with security posture aggregation (Security Hub) or threat detection (GuardDuty).

This question addresses the automation of operating system patching and vulnerability assessment for a hybrid fleet of Windows and Linux EC2 instances. The correct solution combines AWS Systems Manager Patch Manager for updates and Amazon Inspector for security scanning.

Common mistake: Candidates often select Option A because AWS Security Hub is popular, but it aggregates findings rather than performing the active vulnerability scanning required by the prompt.

Expert Analysis

Why the Answer Is Correct

Option B is the only choice that correctly pairs two specialized services for the distinct requirements: patch management and vulnerability assessment. AWS Systems Manager Patch Manager is the standard service for automating the installation of OS patches across diverse fleets (Windows and Linux). Amazon Inspector is specifically designed to continuously scan EC2 instances for software vulnerabilities and deviations from best practices, providing the detailed monthly summary requested.

Why the Other Options Are Wrong

Option A uses AWS Security Hub, which aggregates security data from various sources but does not perform the deep, automated vulnerability scanning itself; it relies on services like Inspector to feed it data. Options C and D are incorrect because AWS Config is a compliance and inventory tool that records resource state changes, not an automated patching engine. Additionally, AWS Shield Advanced protects against DDoS attacks, and GuardDuty detects threats in logs, neither of which handles OS patching or vulnerability reporting.

Community Comment Notes

The community consensus strongly supports Option B. As user TwinSpark noted, "AWS Security Hub performs security best practice checks... Amazon Inspector scan workload for vulnerabilities," highlighting the distinction between aggregation and scanning. Another commenter, Hkayne, emphasized that "AWS Systems Manager Patch Manager to automate the process of installing security-related updates" is the key requirement for the first part of the problem.

Exam Strategy

Always map the action verb to the service function: 'automate updates' points directly to Systems Manager Patch Manager, while 'vulnerability summary' points to Amazon Inspector. Avoid selecting Security Hub unless the question explicitly asks for aggregating findings from multiple AWS accounts or services.

Frequently Asked Questions

Why not use AWS Security Hub instead of Amazon Inspector?

Security Hub aggregates findings from other tools like Inspector. It does not perform the initial vulnerability scanning itself, so you still need Inspector to generate the data.

Can AWS Config automate patch installations?

No. AWS Config tracks configuration changes and compliance status. It cannot install patches or updates on instances; that is the role of Systems Manager Patch Manager.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. TwinSpark 👍 5 Answered B
    AWS Security Hub performs security best practice checks, aggregates alerts, and enables automated remediation. Amazon Inspector scan workload for vulnerabilities Guardduty threat detection for malicious activity in all account AWS Shield DDOS Regarding security B and D can be right (maybe D a little too much). For patching B is the only valid option.
  2. maxhg 👍 4
    inspector for instances and software vulnerabilities
  3. Tanidanindo 👍 3 Answered B
    Inspector for vulnerability scanning
  4. Hkayne 👍 2 Answered B
    AWS Systems Manager Patch Manager to automate the process of installing security-related updates for both the operating system and applications. Amazon Inspector for Automated and continual vulnerability management at scale
  5. mk168898 👍 2
    Inspector is for checking vulnerabilities, so B
Show 3 more comments
  1. KennethNg923 👍 2 Answered B
    Inspector for Common vulnerabilities so it is B
  2. Alagong 👍 1 Answered A
    Create an Auto Scaling group and an ELB in the DR Region, configuring the DynamoDB table as a global table, and setting up DNS failover to the new ELB. This approach allows for quick failover since the infrastructure is already in place and only DNS needs to be updated to redirect traffic.
  3. Awsbeginner87 👍 3 Answered B
    Option b

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide