Which sequence correctly represents the general steps in patch management?

• A. Deploy patches, verify patch effectiveness, discover vulnerabilities, prioritize.
• B. Discover vulnerabilities, prioritize, test patches, deploy, and verify patch effectiveness.
• C. Test patches, discover vulnerabilities, deploy patches, verify.
• D. Prioritize patches, discover vulnerabilities, test patches, deploy.

Answer: (B)

Understanding the proper order of steps in patch management is crucial for effective risk reduction. The process starts with discovering vulnerabilities, so you know what needs fixing. Next is prioritization, which ranks those vulnerabilities by risk, asset importance, and exploit likelihood, ensuring you tackle the most critical issues first. After that comes testing patches to confirm they don’t break systems or cause compatibility problems, and to validate that the fixes will work in reality. Only then do you deploy the patches to affected systems. Finally, verification confirms the patches were applied correctly and that the vulnerabilities are actually remediated, often followed by a re-scan to ensure no new issues were introduced.

This sequence makes sense because you shouldn’t deploy before you know what needs patching or before you’ve tested that the fix is appropriate. Skipping prioritization can waste time on low-risk issues, testing patches without knowing what needs patching can be inefficient, and deploying without verification may leave gaps or hidden problems.