350-201 Question 71
Select 3A healthcare organization has recently discovered that its patient management system is vulnerable to a critical zero-day exploit. The system vendor has released a patch to address the vulnerability. However, the organization is hesitant to apply the patch immediately due to potential disruptions. As the cybersecurity analyst, what steps would you recommend for addressing this situation while ensuring minimal risk to the organization?
- A
Test the patch in a staging environment to ensure compatibility with the patient management system before applying it to production.
- B
Immediately apply the patch to all production systems without testing to close the vulnerability as quickly as possible.
- C
Implement virtual patching, such as using intrusion prevention systems (IPS), to mitigate the risk until the patch can be safely deployed.
- D
Monitor the system for any indicators of compromise (IoCs) related to the vulnerability while preparing for patch deployment.
- E
Delay applying the patch until the next scheduled maintenance window, regardless of the risk posed by the vulnerability.
Show answer and explanation
Correct answers: A, C, D
Explanation
In cybersecurity, addressing critical vulnerabilities requires a balanced approach that minimizes risk while maintaining operational stability. Testing the patch ensures compatibility, virtual patching provides immediate protection, and monitoring for IoCs helps detect any exploitation attempts during the interim. Delaying the patch unnecessarily increases exposure, while applying it without testing risks disrupting critical systems.
- A. Correct.
Testing the patch in a staging environment is a necessary step to ensure that applying the patch will not disrupt critical services or introduce new issues.
- B. Incorrect.
While urgency is important, immediately applying a patch without testing can lead to unforeseen disruptions or failures in the production environment.
- C. Correct.
Virtual patching through solutions like IPS can provide temporary protection against exploitation of the vulnerability while the patch is being tested and prepared for deployment.
- D. Correct.
Monitoring the system for IoCs is crucial to detect any active exploitation attempts while the organization works on deploying the patch.
- E. Incorrect.
Delaying the patch until the next maintenance window could unnecessarily expose the organization to exploitation, especially for a critical vulnerability.