What is the best approach for a technician applying a security patch to an active-passive failover SQL cluster while maintaining service availability?

In a high-availability SQL cluster configured for active-passive failover, maintaining service availability during patching is crucial. The best approach involves patching the passive node first. Once the patching is complete on this node, a failover can be performed to switch the active role to the now-patched node. This minimizes downtime and ensures that services remain available throughout the process.

After the failover, the original active node, which is now passive, can then be patched. This sequential method ensures that at least one node is always operational and serving requests, thus maintaining overall service availability for users.

This approach effectively leverages the capabilities of the failover cluster, achieves compliance with security updates, and minimizes the risk of service disruption, making it the optimal choice. The other strategies would either introduce significant downtime or not fully utilize the capabilities of the failover cluster.