A recent assessment identified that several users' mobile devices are running outdated versions of endpoint security software that do not meet the company's security policy. Which of the following sho

A vulnerability assessment scans and catalogs weaknesses but does not deploy fixes; the deficiency has already been identified as outdated security software, so running another assessment does not remediate the problem.

A risk assessment evaluates the probability and impact of threats and informs decision-making but produces no remediation action; the organization already knows the risk and needs the software updated, not re-evaluated.

Patch management covers the systematic deployment of software updates to endpoints to bring them in line with defined security baselines - applying the missing endpoint security software updates directly remediates the version deficiency identified and returns the devices to a policy-compliant state required for network access.

Device quarantine isolates non-compliant endpoints from the network to limit exposure but does not update or fix the outdated software; quarantine may be a temporary enforcement step but cannot substitute for the actual remediation.

Incident management applies the incident response lifecycle to active security events; outdated security software is a compliance gap requiring remediation, not an active incident that warrants declaration, containment, and post-incident review.