200-201 Question 326
Select 3A cybersecurity analyst at your organization discovers that a critical vulnerability has been identified in a widely-used application. The vendor has released a patch to address the issue, but the patch has not yet been deployed. Which of the following actions should be prioritized as part of the patch management process?
- A
Test the patch in a controlled environment before deploying it to production systems
- B
Immediately deploy the patch to all systems without testing to mitigate the vulnerability
- C
Verify the patch’s integrity and authenticity to ensure it has not been tampered with
- D
Document the patch deployment plan and obtain necessary approvals
- E
Wait for a scheduled maintenance window before applying the patch, regardless of the severity
Show answer and explanation
Correct answers: A, C, D
Explanation
Effective patch management involves a systematic approach to addressing vulnerabilities. Testing the patch, verifying its integrity, and documenting the deployment plan are essential for minimizing risks associated with patch deployment. Skipping these steps or delaying unnecessarily can expose systems to greater risks.
- A. Correct.
Testing the patch in a controlled environment ensures it will not introduce new issues or break any existing functionality. This is a critical step before deployment.
- B. Incorrect.
Immediately deploying the patch without testing can lead to unintended consequences, such as system instability or conflicts with existing applications.
- C. Correct.
Verifying the patch’s integrity and authenticity ensures that the patch is legitimate and has not been altered, which is essential for maintaining security.
- D. Correct.
Documenting the patch deployment plan and obtaining necessary approvals ensures proper coordination and accountability, which are important for organized patch management.
- E. Incorrect.
Waiting for a maintenance window regardless of the severity of the vulnerability may not be appropriate for critical vulnerabilities that require immediate attention.