You must automate patching for Windows EC2 instances using AWS Systems Manager Patch Manager. Development instances should auto-approve patches 2 days after release; production instances should auto-approve 5 days after release. All patching must occur within the same 2-hour maintenance window. Which approach satisfies these requirements?

The correct approach involves using two distinct patch baselines because auto-approval delays are configured within the patch baseline itself, not the patch group. Each patch baseline can then specify a different auto-approval delay (2 days for dev, 5 days for prod). Tagging instances for 'dev' and 'prod' allows you to associate them with the respective patch groups. A single maintenance window is sufficient as the patching operations for both groups can occur within the same scheduled time, with the patch baselines dictating the approval logic. The other options are incorrect because: Auto-approval delays are set in patch baselines, not patch groups. Creating separate maintenance windows for different auto-approval delays is unnecessary and more complex than needed. Not tagging all instances or using predefined baselines for some instances would not meet the requirement for specific auto-approval delays for both dev and prod.