Which of the following encompasses application patch management?

Configuration management encompasses identifying, controlling, and auditing changes to system components including software versions and patches, making application patch management a core subprocess within it. Patch management follows configuration management procedures to ensure applications are updated to approved, secure versions and changes are tracked in a configuration management database (CMDB).

Policy management deals with the creation, distribution, and enforcement of organizational security policies and does not involve the technical process of applying software patches.

Cross-site request forgery (CSRF) is a web application attack where unauthorized commands are sent from a trusted user, and it has no relationship to patch management.

Fuzzing is a dynamic testing technique that sends malformed or random input to applications to discover vulnerabilities - it is a testing methodology, not a patch management process.