A healthcare company runs Amazon Linux EC2 instances and must continuously enforce patch compliance for the OS and applications using both a default and a custom repository. How can patch deployment be automated to use the default and the custom repository?

The correct option leverages AWS Systems Manager Patch Manager, which is designed for automated patch compliance. Creating a custom patch baseline allows you to specify both the default Amazon Linux repositories and your custom repository sources, ensuring all required patches are considered. The AWS-RunPatchBaseline document is the standard Systems Manager Automation document used to scan for and apply patches based on the defined baseline. Incorrect options: AWS Direct Connect is for network connectivity, not patch deployment automation. CloudWatch can schedule actions but doesn't manage patch baselines or repositories directly. Manually adding repositories with yum-config-manager is a one-time configuration step on the instance, not an automated, scalable solution for continuous compliance across many instances. The AWS-AmazonLinuxDefaultPatchBaseline document uses the default Amazon Linux baseline and does not incorporate custom repositories, failing to meet the requirement for both default and custom sources.