(Which service should be used to schedule the patching of EC2 instances and on-premises servers...

AWS Systems Manager should be used to schedule the patching of EC2 instances and on-premises servers with security updates, utilizing features like Patch Manager and maintenance windows. This service supports hybrid environments and automated patch deployment. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Systems Manager Patch Manager) states, "Systems Manager provides Patch Manager to schedule and deploy security updates to EC2 instances and on-premises servers during maintenance windows, ensuring consistent patching across hybrid environments." EventBridge, Config, and App Runner do not offer this patching capability.