CSA Patch Management & Updates 3 — Questions and Answers
Question 1: Which patching approach deploys updates to a small subset of production systems before wider rollout?
- Emergency patching
- Canary deployment (Correct answer)
- Hotfix patching
- Silent patching
Correct answer: Canary deployment
Canary deployment rolls out patches to a small representative group first, allowing administrators to detect issues before affecting the entire environment.
Question 2: What is the role of a patch management policy in an organization?
- To define hardware procurement timelines
- To establish rules, responsibilities, and timelines for applying patches consistently (Correct answer)
- To document network topology changes
- To authorize firewall rule modifications
Correct answer: To establish rules, responsibilities, and timelines for applying patches consistently
A patch management policy sets the organizational framework—including who is responsible and how quickly patches must be applied—to ensure consistent and timely remediation.
Question 3: After deploying a patch in a test environment with no issues, a technician pushes it to production and the application crashes. What should be done FIRST?
- Reimage all production servers
- Execute the rollback plan to restore the previous state (Correct answer)
- Contact the software vendor immediately
- Disable the application permanently
Correct answer: Execute the rollback plan to restore the previous state
Executing the pre-defined rollback plan restores systems to their pre-patch state quickly, minimizing downtime while the root cause is investigated.
Question 4: Which tool category is MOST commonly used to automate enterprise-wide patch deployment?
- Network protocol analyzers
- Patch management platforms (e.g., WSUS, SCCM, Ansible) (Correct answer)
- Intrusion detection systems
- Web application firewalls
Correct answer: Patch management platforms (e.g., WSUS, SCCM, Ansible)
Patch management platforms like WSUS, SCCM, or Ansible automate the scanning, approval, distribution, and verification of patches across large environments.
Question 5: An end user refuses to allow a security patch because it requires a restart during business hours. What is the BEST response?
- Skip the patch permanently
- Schedule the patch and reboot during an approved off-hours maintenance window (Correct answer)
- Grant an indefinite exception
- Uninstall the application requiring the patch
Correct answer: Schedule the patch and reboot during an approved off-hours maintenance window
Scheduling the patch during an off-hours maintenance window balances the user's operational needs with the security requirement to apply the patch promptly.
Question 6: What is the difference between a hotfix and a service pack?
- A hotfix is a planned quarterly update; a service pack is an emergency fix
- A hotfix addresses a specific urgent issue; a service pack is a cumulative collection of patches (Correct answer)
- A hotfix requires a reboot; a service pack does not
- A hotfix is free; a service pack requires a license upgrade
Correct answer: A hotfix addresses a specific urgent issue; a service pack is a cumulative collection of patches
Hotfixes target a single specific issue and are released quickly, while service packs bundle multiple cumulative updates into one installable package.
Question 7: Which of the following is a KEY risk of delaying patch application beyond the defined SLA?
- Increased hardware costs
- Extended window of exposure for known vulnerabilities (Correct answer)
- Loss of vendor support contract
- Reduced network bandwidth
Correct answer: Extended window of exposure for known vulnerabilities
Every day a known vulnerability remains unpatched beyond the SLA increases the organization's exposure to exploitation by threat actors who use public vulnerability information.
CSA Patch Management & Updates 3
Which patching approach deploys updates to a small subset of production systems before wider rollout?