312-50 Question 295
Single answer▪ Patch ManagementDuring an internal security assessment, a CEH discovers that several Windows servers hosting a customer-facing web application are missing recent security updates. The operations team says they delayed patching because a previous update caused application downtime. Management asks for a patch management approach that reduces exposure to known vulnerabilities while minimizing business disruption. Which action is the MOST appropriate to recommend?
- A
Deploy all missing patches directly to the production servers immediately to eliminate the vulnerability window as fast as possible
- B
Establish a formal patch management process that includes asset inventory, patch prioritization based on risk, testing in a staging environment, scheduled rollout, and rollback procedures
- C
Rely on host-based antivirus and the existing firewall until the next annual maintenance cycle, since compensating controls can fully replace patching
- D
Patch only internet-facing servers and leave internal servers unchanged because attackers cannot exploit unpatched systems behind the firewall
Show answer and explanation
Correct answer: B
Explanation
The best answer is to recommend a structured patch management program rather than an ad hoc or all-or-nothing approach. In practice, patch management should include asset discovery, vulnerability and patch assessment, risk-based prioritization, testing, deployment scheduling, verification, documentation, and rollback planning. This aligns with common security and operations guidance from sources such as NIST, including vulnerability management and configuration management best practices. From a CEH perspective, ethical hackers commonly identify missing patches as exploitable weaknesses, but the correct remediation is not simply 'patch everything immediately' without process. The strongest recommendation reduces the attack surface for known CVEs while respecting business continuity requirements.
- A. Incorrect.
This is not the best recommendation. Although rapid remediation is important, pushing all patches straight to production without validation can create outages and operational risk, especially when the team has already experienced a patch-related failure. Effective patch management balances security urgency with change control, testing, and recovery planning.
- B. Correct.
This is correct. A mature patch management process starts with knowing what assets and software versions exist, then prioritizing patches based on exposure and severity, such as critical remote code execution flaws on internet-facing systems. Testing in staging helps identify compatibility issues before production deployment. Scheduled rollout and rollback procedures align with change management best practices and reduce both vulnerability exposure and the likelihood of extended downtime.
- C. Incorrect.
This is incorrect. Antivirus and firewalls are useful compensating controls, but they do not fully address vulnerable software. Many exploits target unpatched services or applications in ways that perimeter and endpoint tools may not stop reliably. Delaying security updates until an annual cycle leaves systems exposed to publicly known vulnerabilities for too long.
- D. Incorrect.
This is incorrect. Internal systems also require patching because attackers often move laterally after gaining an initial foothold, and insider threats are also possible. A firewall does not eliminate the risk from unpatched internal assets. Patch prioritization may place internet-facing systems first, but it should not exclude internal servers from the patch program.