Perform Patch Management (e.g. Secure Release, Testing) CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security patch is released for a vulnerability in a third-party library used by multiple internal applications. The patch is available for download, but the vendor has not yet provided a digital signature for it. The applications are critical to business operations. What is the most appropriate course of action?

   • AContact the vendor to verify the patch's authenticity and request a signed version, while implementing temporary mitigations for the vulnerability.
   • BDeploy the patch to a staging environment, test it thoroughly, and then deploy to production if it passes all tests.
   • CDeploy the patch immediately to all applications to close the vulnerability, as the risk of exploitation is high.
   • DDo not deploy the patch and wait for the vendor to provide a signed version.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An organization is required to provide evidence of patch compliance to a regulator. The organization uses a patch management tool that generates reports. The regulator requires proof that the reports are accurate and cannot be easily falsified. What is the most important control to implement?

   • AStore the reports in a separate, secure location.
   • BEnable detailed logging and auditing within the patch management tool.
   • CRestrict access to the patch management tool to a small group of administrators.
   • DRequire administrators to manually verify the reports on a sample of servers.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security auditor is reviewing the patch management process of an organization. The auditor asks for evidence that all servers are up-to-date with the latest security patches. Which of the following is the most reliable source of evidence to provide?

   • AA spreadsheet maintained by the system administrators listing the patches they believe are installed.
   • BA list of patches downloaded from the vendor's website.
   • CA verbal confirmation from the lead system administrator that all servers are patched.
   • DA report generated by the patch management tool showing the patch status of each server.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the purpose of a rollback plan in patch deployment?

   • ATo ensure the patch is compatible with all hardware
   • BTo revert systems to their pre-patch state if the patch causes issues
   • CTo speed up the patch installation process
   • DTo document the patch's changes for auditors
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A patch for a critical vulnerability is deployed to a staging environment. The testing team runs a series of automated tests, and all tests pass. However, the team is concerned that the tests do not cover all possible user workflows. What is the most effective way to increase confidence in the patch before production deployment?

   • AReview the patch's code changes to identify potential issues.
   • BConduct exploratory testing by a small group of experienced testers to probe for unexpected issues.
   • CRun the automated tests again with a different set of test data.
   • DDeploy the patch to production and rely on the rollback plan if issues occur.
   Reveal Solution Discussion Select an answer first