You manage Windows and Linux servers in Azure and on-premises. Requirements: 1) Patch both Azure and on-prem servers monthly within defined maintenance windows, with reboots coordinated. 2) Ensure the IIS Windows feature remains installed and configured on specific servers. 3) When an Azure Monitor alert fires, execute a PowerShell script on an on-prem file server to archive logs locally. What should you implement?

The correct option addresses all requirements effectively. Azure Automation Update Management centralizes patching for both Azure and on-premises servers, meeting the first requirement. Azure Automation State Configuration (DSC) ensures the IIS feature remains installed and configured, satisfying the second. For the third requirement, a Hybrid Runbook Worker on the on-prem file server allows Azure Monitor to trigger a local PowerShell script via an action group webhook, executing the script directly where needed. Incorrect options fail on multiple points: Azure Update Manager alone doesn't cover on-prem, and Group Policy isn't ideal for consistent state across hybrid environments. JIT VM access is for remote access, not automated script execution. Intune is primarily for endpoint management, not server patching. Azure Functions over SSH might work but is less integrated for on-prem automation than Hybrid Runbook Workers. Azure Arc-enabled servers facilitate management but don't replace the specific capabilities of Update Management or Hybrid Runbook Workers for these tasks. System Center Orchestrator is an older, on-prem solution and doesn't leverage Azure's integrated capabilities for hybrid management.