Which term identifies applications needing patches or updates?

• A. Patch Management
• B. Software Inventory
• C. Vulnerability Assessment
• D. Risk Analysis

Answer: (C)

This question is about spotting remediation needs by finding weaknesses that patches address. A vulnerability assessment is the process of scanning systems for known weaknesses and linking those weaknesses to the patches or updates that fix them. Because of this, it directly identifies which applications have vulnerabilities that require patches, guiding what needs to be patched.

Understanding the other terms helps clarify why this fits best:

• Patch management focuses on the ongoing process of applying patches once they’re identified, i.e., the remediation activity rather than the discovery of what needs patching.

• Software inventory lists what software is installed but doesn’t by itself reveal which items have vulnerabilities needing patches.

• Risk analysis evaluates overall threat impact and likelihood, not the specific patches needed for individual applications.