Patching & Secure Baseline Configurations GMON Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A vulnerability scan of a mixed environment flags two critical patches: one for an internet-facing web server and one for an internal file server. Both are rated CVSS 9.8, but the web server patch has a known exploit in the wild, while the file server patch has no known exploit. The change window allows only one patch tonight. Which patch should be deployed first?

   • AThe web server patch, because it is internet-facing and has an active exploit, making it the highest immediate risk.
   • BThe file server patch, because internal systems are patched less frequently and are more likely to be exploited.
   • CEither patch, because both have the same CVSS score, so the order does not matter.
   • DThe file server patch, because internal systems are more trusted and a compromise there would be more damaging.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst reviews the latest vulnerability scan results. The environment includes internet-facing web servers, internal file servers, and a legacy database server that cannot be patched for at least 60 days. The scan shows a critical remote code execution vulnerability in the web server software, a high-severity privilege escalation issue on the file servers, and a medium-severity issue on the legacy database. The analyst must prioritize patching. Which approach best aligns with risk-based prioritization?

   • APatch the web servers first because they are internet-facing and the vulnerability is remotely exploitable, then address the file servers, and document the legacy database as an exception with compensating controls.
   • BPatch the legacy database first because it has been unpatched the longest, then the file servers, and finally the web servers.
   • CApply the critical patch to the web servers, then immediately attempt to patch the legacy database despite the vendor's lack of support, and defer the file servers.
   • DPatch all systems in the same maintenance window regardless of risk, starting with the file servers because they are internal and less likely to be targeted.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A vulnerability scan of a mixed environment reports that several servers are missing a critical patch. The patch was released two weeks ago, and the vendor has confirmed active exploitation in the wild. The servers are internal but handle sensitive data. What should the security team do first?

   • AIgnore the scan results because the servers are internal and not directly exposed.
   • BPrioritize patching the affected servers immediately because the vulnerability is actively exploited and the risk is high.
   • CRe-scan the servers to confirm the finding, but do not patch until the next change window.
   • DWait until the next scheduled patch cycle to avoid disruption.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of documenting exceptions to baseline policies?

   • ATo transfer the risk to the system owner without review
   • BTo prevent any future changes to the system
   • CTo automatically remove the system from the network
   • DTo provide a record of the deviation and the approved risk acceptance
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A patch management team is planning the monthly patch cycle. They have identified the required patches, but the change management board requires an impact assessment and an approved maintenance window before deployment. The team also wants to reduce manual effort. Which sequence of steps best integrates patching with change management while improving efficiency?

   • ASubmit a change request for the entire year's patch schedule, then deploy patches automatically without further approvals.
   • BSkip testing because the patches are from the vendor and are known to be stable, then deploy manually to all servers.
   • CTest patches in a staging environment, submit a change request with the test results and rollback plan, obtain approval, then deploy using an automated patch tool during the approved window.
   • DDeploy patches immediately to production to reduce risk, then submit a change request after the fact for documentation.
   Reveal Solution Discussion Select an answer first