350-201 Question 70
Select 3A healthcare organization has discovered a critical vulnerability in one of its on-premises web servers, which hosts patient data. The vulnerability has a CVSS score of 9.8 and is actively being exploited in the wild. However, applying the patch requires taking the server offline for 2 hours, which could impact patient services. What should the organization do to address this issue?
- A
Apply the patch immediately during off-peak hours and notify stakeholders about potential downtime.
- B
Delay the patch for a week to minimize operational disruption and continue monitoring for signs of exploitation.
- C
Implement a Web Application Firewall (WAF) rule to mitigate the vulnerability until the patch can be applied.
- D
Take no action since the server is already protected by a perimeter firewall.
- E
Isolate the affected server from the network until the patch can be applied.
Show answer and explanation
Correct answers: A, C, E
Explanation
For a critical vulnerability with a high CVSS score that is actively being exploited, a prioritized approach is essential. Applying the patch as soon as possible is the most effective solution, but additional measures like WAF rules and network isolation can help mitigate risk while minimizing service disruption. Delaying action or relying solely on existing defenses is not advisable in this scenario.
- A. Correct.
Applying the patch during off-peak hours is a valid recommendation for a critical vulnerability with a high CVSS score. Notifying stakeholders ensures transparency about the impact.
- B. Incorrect.
Delaying the patch for a week is not recommended for a vulnerability actively being exploited in the wild, as it increases the risk of a breach.
- C. Correct.
Implementing a WAF rule is a valid temporary measure to mitigate the vulnerability while the patch is planned and applied.
- D. Incorrect.
Relying solely on a perimeter firewall does not address the vulnerability directly and leaves the server at risk of exploitation.
- E. Correct.
Isolating the affected server from the network is a valid containment measure to reduce risk until the vulnerability is patched.