nerdexam
GIAC

GSEC · Question #114

The previous system administrator at your company used to rely heavily on email lists, such as vendor lists and Bug Traq to get information about updates and patches. While a useful means of…

The correct answer is D. The command apt-get upgrade is incorrect, you need to run the apt-get update command. The scripted plan is flawed because apt-get upgrade alone does not refresh the local package index - apt-get update must be run first to pull the latest package lists from remote repositories.

Operating System Security

Question

The previous system administrator at your company used to rely heavily on email lists, such as vendor lists and Bug Traq to get information about updates and patches. While a useful means of acquiring data, this requires time and effort to read through. In an effort to speed things up, you decide to switch to completely automated updates and patching. You set up your systems to automatically patch your production servers using a cron job and a scripted apt-get upgrade command. Of the following reasons, which explains why you may want to avoid this plan?

Options

  • AThe apt-get upgrade command doesn't work with the cron command because of incompatibility
  • BRelying on vendor and 3rd party email lists enables updates via email, for even faster patching
  • CAutomated patching of production servers without prior testing may result in unexpected behavior
  • DThe command apt-get upgrade is incorrect, you need to run the apt-get update command

How the community answered

(33 responses)
  • A
    3% (1)
  • B
    9% (3)
  • C
    6% (2)
  • D
    82% (27)

Why each option

The scripted plan is flawed because apt-get upgrade alone does not refresh the local package index - apt-get update must be run first to pull the latest package lists from remote repositories.

AThe apt-get upgrade command doesn't work with the cron command because of incompatibility

apt-get upgrade is fully compatible with cron scheduling; there is no technical incompatibility between these two tools.

BRelying on vendor and 3rd party email lists enables updates via email, for even faster patching

Vendor and third-party email lists are a passive, manual process that is slower than scripted automation, not faster.

CAutomated patching of production servers without prior testing may result in unexpected behavior

While testing patches before applying them to production is a legitimate best practice concern, it is not marked as the correct answer for this question.

DThe command apt-get upgrade is incorrect, you need to run the apt-get update commandCorrect

On Debian/Ubuntu systems, apt-get upgrade installs newer package versions using only the locally cached package index, which may be stale. Without first running apt-get update to synchronize that index with upstream repositories, the upgrade script may miss recently released security patches entirely. The automated plan as described is therefore incomplete and may not achieve its intended goal of keeping systems fully patched.

Concept tested: Debian apt-get update vs upgrade command distinction

Source: https://manpages.debian.org/bookworm/apt/apt-get.8.en.html

Topics

#patch management#automated updates#apt-get#production systems

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSEC Practice