CSA Patch Management & Updates 2 — Questions and Answers
Question 1: Which patch management phase involves identifying which systems are affected by a newly released vulnerability?
- Remediation
- Detection and identification (Correct answer)
- Rollback planning
- Change control approval
Correct answer: Detection and identification
Detection and identification is the phase where administrators assess which systems in the environment are vulnerable to a newly disclosed issue.
Question 2: A vendor releases a patch that conflicts with a critical line-of-business application. What is the BEST immediate action?
- Deploy the patch immediately to all systems
- Isolate affected systems and apply a compensating control while testing compatibility (Correct answer)
- Ignore the patch until the next maintenance window
- Roll back the entire OS to the previous version
Correct answer: Isolate affected systems and apply a compensating control while testing compatibility
When a patch causes conflicts, isolating vulnerable systems and implementing compensating controls allows time for compatibility testing without leaving systems unprotected.
Question 3: What does the term 'patch Tuesday' refer to in a corporate environment?
- A weekly internal security meeting
- Microsoft's scheduled monthly release of security updates on the second Tuesday (Correct answer)
- A mandatory reboot day for all servers
- The day patches are rolled back if issues are found
Correct answer: Microsoft's scheduled monthly release of security updates on the second Tuesday
Patch Tuesday refers to Microsoft's practice of releasing security patches on the second Tuesday of each month, allowing organizations to plan maintenance windows around it.
Question 4: Which metric from the Common Vulnerability Scoring System (CVSS) MOST influences patch prioritization urgency?
- Vendor name
- Base score severity rating (Correct answer)
- Patch file size
- Number of systems in inventory
Correct answer: Base score severity rating
The CVSS base score rates the intrinsic severity of a vulnerability, helping organizations prioritize which patches to apply first.
Question 5: An organization uses a tiered patching schedule: critical patches within 24 hours, high within 7 days, medium within 30 days. A CVSS 9.8 vulnerability is disclosed. When must it be patched?
- Within 30 days
- Within 7 days
- Within 24 hours (Correct answer)
- At the next quarterly maintenance window
Correct answer: Within 24 hours
A CVSS score of 9.8 is classified as critical (9.0–10.0), requiring patching within 24 hours under this tiered policy.
Question 6: What is the PRIMARY purpose of maintaining a patch inventory baseline?
- To bill departments for software licensing
- To know the current patch state of all assets so gaps can be identified (Correct answer)
- To schedule employee training sessions
- To generate compliance reports for marketing
Correct answer: To know the current patch state of all assets so gaps can be identified
A patch inventory baseline documents the current patch level of all assets, making it possible to identify unpatched systems and measure remediation progress.
Question 7: Which of the following BEST describes a 'zero-day' vulnerability in the context of patch management?
- A vulnerability patched on the same day it was discovered
- A flaw that has been publicly known for zero days before being exploited
- An exploited flaw for which no vendor patch yet exists (Correct answer)
- A vulnerability with a CVSS score of zero
Correct answer: An exploited flaw for which no vendor patch yet exists
A zero-day vulnerability is one that is actively exploited before the vendor has released a patch, leaving defenders with no official fix.
CSA Patch Management & Updates 2
Which patch management phase involves identifying which systems are affected by a newly released vulnerability?