In an IaaS model, to which of the following methodologies would the client apply a list of OS patches, assuming approval from CAB has been given?

In an IaaS environment, the client uses a patch management system to identify the underlying hypervisor type first, which determines guest OS patch compatibility and any virtualization-specific constraints before selecting the target group of VMs. After CAB approval, this methodology ensures OS patches are applied in a controlled, compatibility-verified manner that respects the client-managed layers of the IaaS shared responsibility model.

Identifying only the guest VMs without first identifying the hypervisor type skips the compatibility verification step that ensures OS patches are appropriate for the specific virtualization environment in use.

Identifying applications needing a patch describes application-level patching, not OS-level patching, which is a distinct maintenance scope within the IaaS client responsibility model.

Identifying services for patching rather than the hypervisor type and target guest group does not follow the correct OS patch management methodology for an IaaS environment.