Which statement describes a NOT recommended stage in patch management?

• A. Inventory vulnerabilities
• B. Apply patches in a controlled process
• C. Test patches in staging
• D. Deploy patches directly to production with no rollback

Answer: (D)

Patch management should follow a safe, verifiable lifecycle. Start by inventorying vulnerabilities so you know what needs fixing and prioritize patches accordingly. Apply patches through a controlled process with proper change management, approvals, and documentation to prevent unintended changes. Test patches in a staging environment that mirrors production to catch compatibility issues and ensure they don’t break critical functionality. Finally, deploy patches with a rollback plan and reliable backups so you can revert quickly if anything goes wrong after deployment.

Deploying patches directly to production with no rollback is not recommended because it bypasses testing and safeguards. If a patch introduces instability, incompatibilities, or service disruption, there’s no prepared way to revert quickly, leading to outages and data loss. This is why a direct-to-production, no-rollback approach is avoided in mature patch management practices.