A security patch for a widely used application has been released. The patch addresses a critical remote code execution vulnerability. The company's change management policy requires that all patches be tested before deployment. However, the vulnerability is being actively exploited in the wild. What is the most appropriate action?

Wait for the next scheduled maintenance window to test and deploy the patch.

Apply the patch only to internet-facing servers and skip internal servers.

Deploy the patch directly to production without testing to address the active exploitation as quickly as possible.

Expedite the testing process, but still test the patch in a staging environment before production deployment.

Which strategy helps minimize disruption when deploying patches to a large number of systems?

Deploying patches in phases or groups

Skipping patches for systems that are not critical

Deploying patches only during business hours

Deploying patches to all systems at once

A company is decommissioning old servers that have reached their end-of-life. The servers contain sensitive data on their hard drives. The security team must ensure that the data is not recoverable before the hardware is disposed of. Which action is most appropriate?

Delete the files and folders from the drives and then reformat the drives.

Remove the drives and store them in a secure warehouse for future use.

Perform a cryptographic erase of the drives or physically destroy the drives.

Document the decommissioning process and then hand the servers to a recycling vendor.

Which hardware security measure is specifically aimed at addressing vulnerabilities discovered in a device's firmware after it has been deployed?

Configuring a host-based firewall

Why is it important to test patches in a staging environment before deploying them to production?

To reduce the cost of the patch

To speed up the deployment process

To ensure the patch does not introduce new issues or break existing functionality

To avoid the need for documentation

Certified Secure Software Lifecycle Professional

Domain 7Objective 2

Secure Configuration and Version Control CSSLP Practice Questions (Page 4)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

10concepts

11%of the exam

Questions 16–20

16application · medium
A security patch for a widely used application has been released. The patch addresses a critical remote code execution vulnerability. The company's change management policy requires that all patches be tested before deployment. However, the vulnerability is being actively exploited in the wild. What is the most appropriate action?
Select an answer first
17foundation · easy
Which strategy helps minimize disruption when deploying patches to a large number of systems?
Select an answer first
18application · medium
A company is decommissioning old servers that have reached their end-of-life. The servers contain sensitive data on their hard drives. The security team must ensure that the data is not recoverable before the hardware is disposed of. Which action is most appropriate?
Select an answer first
19foundation · easy
Which hardware security measure is specifically aimed at addressing vulnerabilities discovered in a device's firmware after it has been deployed?
Select an answer first
20foundation · easy
Why is it important to test patches in a staging environment before deploying them to production?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.