nerdexam
Isaca

CRISC · Question #305

An enterprise has taken delivery of software patches that address vulnerabilities in its core business software. Prior to implementation, which of the following is the MOST important task to be…

The correct answer is A. Assess the impact of applying the patches on the production environment. Before implementing software patches, assessing their impact on the production environment is crucial to prevent unforeseen disruptions and ensure business continuity.

Submitted by salim_om· Apr 18, 2026IT Risk Assessment

Question

An enterprise has taken delivery of software patches that address vulnerabilities in its core business software. Prior to implementation, which of the following is the MOST important task to be performed?

Options

  • AAssess the impact of applying the patches on the production environment.
  • BSurvey other enterprises regarding their experiences with applying these patches.
  • CSeek information from the software vendor to enable effective application of the patches.
  • DDetermine in advance an off-peak period to apply the patches.

How the community answered

(20 responses)
  • A
    75% (15)
  • B
    15% (3)
  • C
    5% (1)
  • D
    5% (1)

Why each option

Before implementing software patches, assessing their impact on the production environment is crucial to prevent unforeseen disruptions and ensure business continuity.

AAssess the impact of applying the patches on the production environment.Correct

Applying patches, especially to core business software, can introduce new issues or break existing functionalities. A thorough impact assessment in a non-production environment helps identify potential compatibility problems, performance degradation, or operational disruptions before they affect live services, ensuring stability and functionality.

BSurvey other enterprises regarding their experiences with applying these patches.

Surveying other enterprises for their experiences can be helpful for gathering insights but is not the most critical or reliable task compared to direct testing of the patches within the organization's specific environment.

CSeek information from the software vendor to enable effective application of the patches.

Seeking information from the software vendor is important for understanding the patches, but this information alone does not substitute for testing their actual impact on the unique production environment.

DDetermine in advance an off-peak period to apply the patches.

Determining an off-peak period for patch application is a critical logistical step to minimize disruption but assumes the patches will work as expected; impact assessment verifies this assumption first.

Concept tested: Patch management impact assessment

Source: https://learn.microsoft.com/en-us/windows-server/get-started/patching-strategies

Topics

#Risk Assessment#Impact Analysis#Patch Management Risks#Vulnerability Remediation

Community Discussion

No community discussion yet for this question.

Full CRISC Practice