A security team reviews patching metrics and finds that the average time to patch critical vulnerabilities is 30 days, but the goal is 7 days. The delay is caused by manual testing and approval steps. What is the best improvement to reduce the time to patch?

Require all patches to be applied within 24 hours.

Reduce the number of systems that receive patches.

Increase the frequency of vulnerability scans.

Automate testing in a staging environment and streamline the approval process for critical patches.

When a system cannot be patched immediately, what is the recommended practice?

Ignore the system until it can be patched

Apply the patch without testing

Disconnect the system from the network permanently

Document the exception and implement compensating controls to mitigate risk

A vulnerability scan reports that a server is missing a patch that was released six months ago. The server is not exposed to the internet and the vulnerability has no known exploit. What is the most appropriate action?

Apply the patch during the next scheduled maintenance window.

Apply the patch immediately because it is six months old.

Re-scan the server to confirm the finding.

Ignore the finding because the server is internal.

A security team reviews the past year's patching metrics and finds that the average time to patch critical vulnerabilities is 30 days, but the organization's goal is 7 days. The team also notices that many patches fail during deployment due to missing prerequisites. Which improvement is most likely to reduce the time to patch and increase success?

Stop tracking the time-to-patch metric because it is not useful.

Automate the prerequisite checks and patch deployment, and use the metrics to identify and address recurring failure causes.

Lower the patching goal to 30 days to match the current performance.

Increase the frequency of vulnerability scans but keep the manual patch process unchanged.

A new critical patch is released for a widely used application. The patch fixes a remote code execution vulnerability. What is the first step in the patch management process?

Test the patch in a lab environment.

Document the patch in the change management system.

Deploy the patch to all systems immediately.

Identify all systems running the affected application.

GIAC Continuous Monitoring Certification

Domain 4Objective 3

Patching & Secure Baseline Configurations GMON Practice Questions (Page 9)

Part of the Configuration and Vulnerability Management domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 41–45

41expert · hard
A security team reviews patching metrics and finds that the average time to patch critical vulnerabilities is 30 days, but the goal is 7 days. The delay is caused by manual testing and approval steps. What is the best improvement to reduce the time to patch?
Select an answer first
42foundation · easy
When a system cannot be patched immediately, what is the recommended practice?
Select an answer first
43application · medium
A vulnerability scan reports that a server is missing a patch that was released six months ago. The server is not exposed to the internet and the vulnerability has no known exploit. What is the most appropriate action?
Select an answer first
44expert · hard
A security team reviews the past year's patching metrics and finds that the average time to patch critical vulnerabilities is 30 days, but the organization's goal is 7 days. The team also notices that many patches fail during deployment due to missing prerequisites. Which improvement is most likely to reduce the time to patch and increase success?
Select an answer first
45application · medium
A new critical patch is released for a widely used application. The patch fixes a remote code execution vulnerability. What is the first step in the patch management process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.