CSA Patch Management & Updates 2

Question 1

Which patch management phase involves identifying which systems are affected by a newly released vulnerability?

Accepted Answer

Detection and identification

Answer

Detection and identification is the phase where administrators assess which systems in the environment are vulnerable to a newly disclosed issue.

Question 2

A vendor releases a patch that conflicts with a critical line-of-business application. What is the BEST immediate action?

Accepted Answer

Isolate affected systems and apply a compensating control while testing compatibility

Answer

When a patch causes conflicts, isolating vulnerable systems and implementing compensating controls allows time for compatibility testing without leaving systems unprotected.

Question 3

What does the term 'patch Tuesday' refer to in a corporate environment?

Accepted Answer

Microsoft's scheduled monthly release of security updates on the second Tuesday

Answer

Patch Tuesday refers to Microsoft's practice of releasing security patches on the second Tuesday of each month, allowing organizations to plan maintenance windows around it.

Question 4

Which metric from the Common Vulnerability Scoring System (CVSS) MOST influences patch prioritization urgency?

Accepted Answer

Base score severity rating

Answer

The CVSS base score rates the intrinsic severity of a vulnerability, helping organizations prioritize which patches to apply first.

Question 5

An organization uses a tiered patching schedule: critical patches within 24 hours, high within 7 days, medium within 30 days. A CVSS 9.8 vulnerability is disclosed. When must it be patched?

Accepted Answer

Within 24 hours

Answer

A CVSS score of 9.8 is classified as critical (9.0–10.0), requiring patching within 24 hours under this tiered policy.

(CSA) Certified Sales Associate Practice Test

(CSA) Certified Sales Associate Practice Test

CSA Patch Management & Updates 2