7.8 - Implement and Support Patch and Vulnerability Management CISSP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company needs to deploy a patch that requires a system reboot. The patch is for a low-severity issue. The company has a policy that all changes must be approved by the change advisory board (CAB). What is the most appropriate action?

   • ASubmit a change request and schedule the deployment during the next maintenance window.
   • BSkip the patch because it is low severity.
   • CDeploy the patch during business hours to get it done quickly.
   • DDeploy the patch immediately since it is low severity.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A patch management team wants to deploy a non-critical patch to a production server. The change management policy requires all changes to be approved by a change advisory board (CAB). What should the team do to comply with the policy?

   • ASubmit a change request to the CAB and wait for approval before deploying the patch.
   • BDeploy the patch without approval because it is non-critical.
   • CDeploy the patch immediately and inform the CAB after the fact.
   • DClassify the patch as an emergency change to bypass the CAB.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which vulnerability should be patched first according to risk-based prioritization?

   • AA low-severity vulnerability on a high-criticality system
   • BA high-severity, actively exploited vulnerability on a critical system
   • CA medium-severity vulnerability with no known exploit on a non-critical system
   • DA high-severity vulnerability on a low-criticality system
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary benefit of using automation in patch management?

   • AIt reduces the manual effort required to deploy patches
   • BIt guarantees all patches are successful
   • CIt removes the need for change management
   • DIt eliminates the need for vulnerability scanning
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security manager wants to measure the effectiveness of the patch management program. Which metric best indicates how quickly the organization responds to newly discovered vulnerabilities?

   • ANumber of vulnerabilities identified in the last quarter.
   • BPercentage of systems with the latest patches installed.
   • CMean time to remediate (MTTR) critical vulnerabilities.
   • DTotal number of patches deployed in the last month.
   Reveal Solution Discussion Select an answer first