712-50 Question 330
Single answerUnderstand system logs, patch management process and configuration management for information system securityA global enterprise has experienced several security incidents caused by delayed patching and undocumented configuration changes on internet-facing Linux servers. The CISO wants a process that improves security without causing repeated outages to a revenue-generating application that depends on those servers. During a recent review, the team found that administrators sometimes apply emergency patches directly in production, system logs are stored only locally on each server, and server build settings differ from one environment to another. Which action should the CISO prioritize FIRST to most effectively reduce risk while improving governance across logging, patch management, and configuration management?
- A
Implement a formal change and configuration management baseline with centralized log collection, and require patches to be risk-ranked, tested against the baseline, approved through emergency or standard change paths, and verified after deployment
- B
Mandate that all critical patches be applied immediately to production as soon as vendors release them, and review logs locally on each server after deployment to confirm service availability
- C
Delay patching of internet-facing servers until the next quarterly maintenance cycle so operations can fully document all server differences before any changes are made
- D
Allow application owners to decide patch timing independently for their servers, provided they notify security after changes are completed
Show answer and explanation
Correct answer: A
Explanation
The best answer is the establishment of an integrated governance process that ties together secure configuration baselines, centralized logging, and risk-based patch management. The scenario describes three interrelated weaknesses: undocumented configuration changes, locally stored logs, and ad hoc emergency patching in production. Addressing them separately would help, but the highest-value first step at the CISO level is to implement a formal control framework that standardizes how systems are built, changed, monitored, and validated.
From a best-practice perspective, this aligns with widely accepted guidance. NIST SP 800-40 emphasizes risk-based enterprise patch management with prioritization, testing, deployment, and verification. NIST SP 800-128 addresses security-focused configuration management and the importance of maintaining approved baselines and controlling deviations. NIST SP 800-92 recommends centralized log management to improve monitoring, retention, correlation, and forensic usefulness. CIS Controls also support these practices through secure configuration, continuous vulnerability management, audit log management, and controlled use of administrative privileges.
For a CCISO-level decision maker, the key is not merely choosing a technical fix, but instituting governance that balances confidentiality, integrity, and availability. Emergency changes still need a defined path, logging should support enterprise oversight and investigations, and patching should be rapid but controlled. This approach reduces operational risk, improves auditability, and creates a repeatable process across business-critical systems.
- A. Correct.
Correct. This option addresses the root governance failures across all three control areas named in the scenario: logging, patch management, and configuration management. A defined secure baseline reduces configuration drift; centralized log collection improves monitoring, incident response, and integrity of audit data; and a risk-based patch process with testing and emergency change handling balances security urgency with availability needs. Post-deployment verification is also a key operational control to confirm that the patch was successfully applied and that the system remains compliant with the approved configuration.
- B. Incorrect.
Incorrect. Applying all critical patches immediately in production without testing or change control is a common but risky misconception, especially for revenue-generating systems with uptime requirements. It may be appropriate to expedite some patches, but bypassing governance can create outages and inconsistent configurations. Reviewing logs only locally is also weak practice because local logs can be altered, lost, or unavailable during an incident; centralized logging is preferred for security monitoring and investigation.
- C. Incorrect.
Incorrect. Deferring patching of internet-facing servers until a quarterly cycle would likely increase exposure to known vulnerabilities, especially for externally accessible assets. While documenting environment differences is important, it should not become a reason to postpone remediation of material security risk. Mature patch management uses risk-based prioritization and compensating controls where needed, not blanket delay.
- D. Incorrect.
Incorrect. Letting application owners decide patch timing independently without a centrally governed process leads to inconsistency, weak accountability, and greater configuration drift. Notification after the fact does not provide effective oversight or risk approval. Security and IT operations should use a formal process with defined ownership, change authorization, and compliance validation.