2.6 Determine Patching Recommendations, Given a Scenario 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company runs a critical database server that cannot be rebooted during business hours. The vendor released a security patch that requires a reboot. The patch addresses a vulnerability that is not currently being exploited in the wild. What should the administrator do?

   • ASchedule the patch for the next maintenance window and test it on a non-production replica first.
   • BApply the patch without a reboot, assuming the patch will take effect immediately.
   • CApply the patch immediately and accept the brief downtime, since security is the top priority.
   • DSkip the patch because the vulnerability is not being exploited, and wait for the next major version.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A vulnerability scanner reports that a web application is running an outdated version of a content management system (CMS) with a known SQL injection vulnerability. The CMS vendor has released a security patch, but the application is heavily customized and the patch may break custom modules. What should the security team do first?

   • AAsk the vendor for a custom patch that does not affect custom modules, without testing it.
   • BApply the patch immediately to all production instances to mitigate the SQL injection risk.
   • CDisable the CMS entirely until the patch is available, to eliminate the vulnerability.
   • DVerify the exact CMS version and the specific vulnerability details, then test the patch in a staging environment.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A hospital's patient-monitoring system runs on a legacy operating system that is no longer supported by the vendor. A critical vulnerability has been disclosed for this OS, but the system cannot be taken offline during patient care hours. What should the security team recommend?

   • AUpgrade the OS immediately during business hours to eliminate the vulnerability
   • BApply a virtual patch or compensating control, and schedule the OS upgrade during the next planned downtime
   • CDisconnect the system from the network until the OS is upgraded
   • DImmediately install the vendor patch even though the OS is unsupported
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A vulnerability report indicates that a server is running an outdated version of an application that is vulnerable to a cross-site scripting (XSS) attack. The application is behind a web application firewall (WAF) that filters XSS payloads. The vendor has released a patch, but the patch requires a reboot and the server is a domain controller. What should the administrator do?

   • AReplace the application with a different product that is not vulnerable.
   • BDo not apply the patch because the WAF already mitigates the XSS vulnerability.
   • CApply the patch immediately because the server is a domain controller and the vulnerability is serious.
   • DVerify the exact version and the WAF's coverage, then schedule the patch during a maintenance window.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's industrial control system (ICS) runs on a legacy Windows version that is no longer supported. A critical vulnerability is disclosed, but the ICS cannot be rebooted without halting production. What should the company do?

   • AUpgrade the OS immediately during production hours
   • BReboot the ICS immediately to install the vendor patch
   • CApply a compensating control, such as network segmentation, and schedule the upgrade during the next planned production halt
   • DDisconnect the ICS from the network until the OS is upgraded
   Reveal Solution Discussion Select an answer first