A security analyst discovers that a critical vulnerability exists in a third-party application used across the organization. The vendor has released a patch, but the change management board is concerned about potential downtime. What is the most appropriate action?

Apply the patch only to development systems and not to production, to avoid any risk to critical services.

Wait for the next scheduled patch cycle, even if it is months away, to avoid any disruption.

Document the patch as a change, assess the risk of not patching, and schedule the patch during a maintenance window with rollback plans.

Apply the patch immediately to all systems to eliminate the vulnerability, regardless of the change management process.

Certified in Cybersecurity

Domain 5Objective 2

5.2 - Understand System Hardening CC Practice Questions (Page 6)

Part of the Security Operations domain, which accounts for 18% of the CC exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

6concepts

18%of the exam

Questions 26–26

26application · medium
A security analyst discovers that a critical vulnerability exists in a third-party application used across the organization. The vendor has released a patch, but the change management board is concerned about potential downtime. What is the most appropriate action?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CC” is a trademark of its owner, used for identification only.

5.2 - Understand System Hardening CC Practice Questions (Page 6)

Questions 26–26

A security analyst discovers that a critical vulnerability exists in a third-party application used across the organization. The vendor has released a patch, but the change management board is concerned about potential downtime. What is the most appropriate action?

Keep studying — Security Operations