The security configuration management policy states that all patches must undergo testing procedures before being moved into production. The security analyst notices a single web application server…

Rescheduling the automated patching to business hours does not address the core policy violation, which is that patches are being applied without required testing.

Monitoring for abnormal bandwidth is insufficient as a sole response because it does not investigate or remediate the unauthorized configuration that is bypassing the patch testing requirement.

Security configuration management policy explicitly mandates that all patches undergo testing before production deployment, and a server bypassing this process constitutes a policy violation and an unauthorized change that must be formally tracked. Creating an incident ticket initiates the proper investigation to determine how the server's update settings were misconfigured or tampered with, ensuring accountability and preventing recurrence. Documenting the event is required even when no immediate harm is observed, because the policy breach itself is the security concern.

Monitoring for service interruptions is a reactive measure that ignores the policy violation and does not investigate the root cause of the unauthorized automated patching.