Patching & Secure Baseline Configurations GMON Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company has a critical application that cannot tolerate downtime during business hours. The patch management team wants to deploy a security patch that requires a reboot. The change management policy requires a two-week notice for any production change. The patch addresses a vulnerability that is being actively exploited. What is the best course of action?

   • AWait the full two weeks to comply with the change management policy, even though the vulnerability is actively exploited.
   • BSubmit an emergency change request with a risk assessment, test the patch in a staging environment, and schedule the deployment for the next maintenance window, even if it is sooner than two weeks.
   • CApply the patch to production without testing to save time.
   • DDeploy the patch immediately without any change request because it is a security patch.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of compliance monitoring in the context of patching and baselines?

   • ATo replace the need for vulnerability scanning
   • BTo provide a help desk for user issues
   • CTo automatically apply patches without human intervention
   • DTo continuously check that systems meet patching and configuration policies
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A vulnerability scan identifies the following issues: a critical vulnerability on a public-facing web server, a high-severity vulnerability on an internal database, and a medium-severity vulnerability on a development server. The web server vulnerability is not yet exploited, but the database vulnerability is being actively exploited. Which patch should be applied first?

   • AThe database patch, because the vulnerability is actively exploited and the database holds sensitive data.
   • BThe web server patch, because it is public-facing and the severity is critical.
   • CThe development server patch, because it is easier to patch and test.
   • DAll patches at the same time, because delaying any patch is unacceptable.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization wants to automate the deployment of security patches to its server fleet. They also want to ensure that the patches do not break critical applications. What is the best approach?

   • ADeploy all patches automatically without testing.
   • BUse an automated patch management tool with a staged rollout and pre-deployment testing.
   • CUse a script that deploys all patches at once.
   • DAutomate only non-critical patches and manually deploy critical ones.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   After a major security incident, a review finds that a critical patch was not applied because it was not prioritized. What is the best way to prevent this from recurring?

   • AIncrease the frequency of vulnerability scans.
   • BRequire that all patches be applied within 24 hours of release.
   • CDisable the patch management system to avoid missing patches.
   • DReview the patch prioritization criteria and update them based on the incident.
   Reveal Solution Discussion Select an answer first