CRISC · Question #305
An enterprise has taken delivery of software patches that address vulnerabilities in its core business software. Prior to implementation, which of the following is the MOST important task to be…
The correct answer is A. Assess the impact of applying the patches on the production environment. Before implementing software patches, assessing their impact on the production environment is crucial to prevent unforeseen disruptions and ensure business continuity.
Question
An enterprise has taken delivery of software patches that address vulnerabilities in its core business software. Prior to implementation, which of the following is the MOST important task to be performed?
Options
- AAssess the impact of applying the patches on the production environment.
- BSurvey other enterprises regarding their experiences with applying these patches.
- CSeek information from the software vendor to enable effective application of the patches.
- DDetermine in advance an off-peak period to apply the patches.
How the community answered
(20 responses)- A75% (15)
- B15% (3)
- C5% (1)
- D5% (1)
Why each option
Before implementing software patches, assessing their impact on the production environment is crucial to prevent unforeseen disruptions and ensure business continuity.
Applying patches, especially to core business software, can introduce new issues or break existing functionalities. A thorough impact assessment in a non-production environment helps identify potential compatibility problems, performance degradation, or operational disruptions before they affect live services, ensuring stability and functionality.
Surveying other enterprises for their experiences can be helpful for gathering insights but is not the most critical or reliable task compared to direct testing of the patches within the organization's specific environment.
Seeking information from the software vendor is important for understanding the patches, but this information alone does not substitute for testing their actual impact on the unique production environment.
Determining an off-peak period for patch application is a critical logistical step to minimize disruption but assumes the patches will work as expected; impact assessment verifies this assumption first.
Concept tested: Patch management impact assessment
Source: https://learn.microsoft.com/en-us/windows-server/get-started/patching-strategies
Topics
Community Discussion
No community discussion yet for this question.