Which description best captures a key practice in patch management?

• A. Inventory vulnerabilities, apply patches in a controlled process, test in staging, and deploy with rollback.
• B. Patch deployment directly to production without testing.
• C. Ignore patches to avoid downtime.
• D. Patch only during quarterly maintenance windows.

Answer: (A)

In patch management, a disciplined, auditable process is essential: you first inventory vulnerabilities to know what needs updating, then apply patches through a controlled workflow, test them in a staging environment to catch compatibility issues, and deploy with a rollback option in case something goes wrong. This approach keeps systems secure while reducing the risk of downtime or broken functionality, because you verify changes before they reach production and can undo them if needed. Patching directly to production without testing bypasses these safeguards and can cause outages or new defects. Ignoring patches leaves known vulnerabilities open to exploitation, and waiting for a quarterly window can leave systems exposed longer than necessary and may not accommodate urgent security needs.