Which of the following is a risk associated with manual patching especially in the cloud?

While there might be no notice for an impact from a failed patch, the process of manual patching itself involves deliberate action and often scheduled maintenance, so 'no notice before the impact is realized' is not the primary risk of manual patching, but rather a consequence if it goes wrong.

The applicability of patches is determined by the vendor and system, not a specific risk of the manual aspect of patching; automation tools would still need to determine applicability.

The effectiveness of a patch in addressing a vulnerability is a quality control issue with the patch itself, not a risk introduced by the manual application process.

Manual patching relies on human administrators to identify, download, test, and apply patches, making it highly susceptible to errors such as applying the wrong patch, missing critical updates, or misconfiguring systems, which can lead to vulnerabilities or service disruptions. In a cloud environment with numerous instances and services, this risk is amplified.