A software vendor is preparing to release a critical security patch to its customers. The patch is a binary executable. The release engineer wants to ensure that customers can verify the patch's authenticity and integrity after download. Which combination of actions is essential for a secure release?

Upload the patch to a public cloud storage service and share the link with customers.

Compress the patch into a ZIP file and provide an MD5 checksum on the download page.

Encrypt the patch with a password and send the password to customers in a separate email.

Digitally sign the patch with the vendor's private key and provide the corresponding public key certificate for verification.

What is the primary purpose of digitally signing a patch before release?

To encrypt the patch so only authorized users can install it

To compress the patch for faster download

To ensure the patch has not been tampered with and originates from a trusted source

To make the patch compatible with all operating systems

Which testing strategy is most appropriate for validating a patch that affects a critical business application with limited downtime windows?

Relying on the vendor's internal testing results

Deploying the patch directly to production without testing

Performing a full regression test in a staging environment that mirrors production

Testing only on a developer's workstation

Which of the following is a common method to verify the integrity of a patch before installation?

Comparing the patch's hash value to the vendor-published hash

Reading the patch's release notes

Checking the patch's file size against the vendor's website

Running the patch on a test system first

What is the primary purpose of tracking patch compliance across an organization?

To speed up the patch deployment process

To ensure all systems have the required patches applied

To eliminate the need for vulnerability scanning

To reduce the number of patches released by vendors

Certified Secure Software Lifecycle Professional

Domain 7Objective 9

Perform Patch Management (e.g. Secure Release, Testing) CSSLP Practice Questions (Page 3)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

5concepts

11%of the exam

Questions 11–15

11application · medium
A software vendor is preparing to release a critical security patch to its customers. The patch is a binary executable. The release engineer wants to ensure that customers can verify the patch's authenticity and integrity after download. Which combination of actions is essential for a secure release?
Select an answer first
12foundation · easy
What is the primary purpose of digitally signing a patch before release?
Select an answer first
13foundation · easy
Which testing strategy is most appropriate for validating a patch that affects a critical business application with limited downtime windows?
Select an answer first
14foundation · easy
Which of the following is a common method to verify the integrity of a patch before installation?
Select an answer first
15foundation · easy
What is the primary purpose of tracking patch compliance across an organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.