The correct answer is Validate patches in a staging environment before promoting them to production.

This approach lets you test patches against representative systems and workloads before they reach production. Using a staging environment helps detect regressions, compatibility issues, and performance regressions while preserving production reliability. It also supports running automated and manual acceptance tests and enables phased rollouts and safe rollback plans when problems occur.

Schedule recurring monthly maintenance windows for patching is not sufficient by itself because a fixed monthly cadence can leave critical vulnerabilities unaddressed between windows and it does not ensure patches are compatibility tested. Maintenance windows can be useful but they must be combined with testing and emergency patch procedures.

Deploy patches to all hosts immediately upon release is risky because immediate, universal deployment can cause outages or data loss when a patch interacts badly with local configurations or custom applications. Production stability requires validation and staged deployment rather than blanket immediate installs.

Assess patches primarily on the vendor's reputation before applying them is inadequate because vendor reputation does not reveal how a patch will behave in your environment or whether it introduces regressions. Patch decisions should be based on vulnerability severity, exploitability, and test results rather than reputation alone.

Full AWS Practitioner Certification Question