A water utility wants security patches on OT-adjacent Windows jump boxes only after a small test ring succeeds. Which Workspace ONE rollout is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Water-plant jump boxes are not the whole utility. Start in a test organization group, then widen the ring after the patch behaves.
Full Explanation
A water utility wanting security patches on OT-adjacent Windows jump boxes only after a small test ring succeeds should assign the patch first to a test organization group of OT-adjacent Windows, then expand after validation. Treat the test organization group as a pilot pump house: prove the KB on a few OT-adjacent jump boxes before opening the patch to the wider utility fleet that can touch industrial systems. Publishing the patch to every enrolled utility device immediately fails by concept because it skips the test ring and risks OT-adjacent impact across the estate. Bypassing Workspace ONE and using an NSX-T Gateway Firewall change as the patch ring fails because gateway firewall changes do not install Windows patches and cannot create a UEM test ring. Putting all OT-adjacent devices in Carbon Black Cloud bypass until the patch is proven fails because bypass weakens prevention during the highest-uncertainty window and is not a patch rollout ring. Exam caveat: staged UEM rollout via a test organization group then expansion is the correct OT-adjacent patch pattern. Operational check: assign the KB to the OT-adjacent test OG, validate jump-box health and vendor compatibility, expand only after sign-off to production OGs, and record stage gates in the utility patch runbook.