An online media company runs its application on Amazon EC2 instances with Amazon Linux 2 and manages the fleet with AWS Systems Manager. The company uses the AWS-AmazonLinux2DefaultPatchBaseline in Patch Manager for patches and updates. For an upcoming high-profile event, the company needs a solution to immediately deploy security patches to all instances in response to incidents or vulnerabilities and to provide centralized proof that patches were applied successfully. Which combination of actions will meet these requirements? (Choose two.)

Creating a new Patch Manager baseline with Amazon Linux 2 as the product, Security as the classification, and automatic approval set to 0 days ensures that security patches are approved immediately upon release. Setting this as the default baseline for Amazon Linux 2 ensures it's applied to the relevant instances. Using Patch Now with the "scan and install" operation immediately applies these approved security patches to all managed nodes. Specifying an Amazon S3 bucket for patching logs provides centralized proof of successful patch application. The incorrect options are less effective or don't meet all requirements. Cloning the default baseline and setting approval to 1 day introduces a delay, which is not suitable for immediate patching. Creating a patch policy with an hourly scan schedule doesn't guarantee immediate deployment in response to an incident; it's more for routine patching. Application Manager reviews installed packages but doesn't directly validate patch application in the context of providing centralized proof for compliance.