nerdexam
CompTIA

CAS-002 · Question #102

The Chief Information Officer (CIO) of Company XYZ has returned from a large IT conference where one of the topics was defending against zero day attacks specifically deploying third party patches…

The correct answer is A. The company does not have an adequate test environment to validate the impact of the. Without a test environment, the company cannot validate whether a third-party patch causes system instability or introduces new vulnerabilities before deploying it to production.

Enterprise Security

Question

The Chief Information Officer (CIO) of Company XYZ has returned from a large IT conference where one of the topics was defending against zero day attacks specifically deploying third party patches to vulnerable software. Two months prior, the majority of the company systems were compromised because of a zero day exploit. Due to budget constraints the company only has operational systems. The CIO wants the Security Manager to research the use of these patches. Which of the following is the GREATEST concern with the use of a third party patch to mitigate another un-patched vulnerability?

Options

  • AThe company does not have an adequate test environment to validate the impact of the
  • BThe third party patch may introduce additional unforeseen risks and void the software
  • CThe company's patch management solution only supports patches and updates released
  • DAnother period of vulnerability will be introduced because of the need to remove the third

How the community answered

(51 responses)
  • A
    55% (28)
  • B
    6% (3)
  • C
    12% (6)
  • D
    27% (14)

Why each option

Without a test environment, the company cannot validate whether a third-party patch causes system instability or introduces new vulnerabilities before deploying it to production.

AThe company does not have an adequate test environment to validate the impact of theCorrect

A test environment is required to evaluate the behavior and side effects of any patch, and this is especially critical for third-party patches that have not undergone the original software vendor's quality assurance process. Deploying an unvalidated patch directly to production operational systems risks introducing outages, compatibility failures, or new exploitable conditions that could be more severe than the original unpatched vulnerability.

BThe third party patch may introduce additional unforeseen risks and void the software

Voiding a software warranty is a legitimate concern but is secondary to the direct operational and security risk of deploying an untested patch onto live production systems with no rollback environment.

CThe company's patch management solution only supports patches and updates released

A limitation in the patch management tooling is a logistical obstacle, but the fundamental greatest risk is the inability to test the patch before it affects production - not the tool's compatibility.

DAnother period of vulnerability will be introduced because of the need to remove the third

A temporary vulnerability window during patch application is a manageable, time-bounded risk compared to the open-ended risk of running an unvalidated patch on production systems.

Concept tested: Third-party patch risk management and test environment dependency

Source: https://csrc.nist.gov/publications/detail/sp/800-40/rev-3/final

Topics

#zero-day vulnerabilities#third-party patches#patch management#risk analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice