CISSP - Security Operations - Section 7.8

Implement and support patch and vulnerability management.

Implement patch management and vulnerability management processes that cover discovery, prioritisation, testing, and deployment of patches within defined remediation timelines. Distinguish between vulnerability management (identifying and tracking weaknesses) and patch management (deploying vendor-supplied fixes) so that the correct workflow applies to each finding.

patch managementvulnerability managementremediationdeployment

Practice question for this objective

Free sampleSecurity Operationsmedium

A manufacturer is preparing to deploy a vendor security patch to a fleet of production servers that run a critical order-processing application. What should the security professional ensure happens BEFORE the patch is rolled out to production?

  • AThe patch is tested in a representative non-production environment and a rollback procedure is documented and verified. Correct
  • BThe vendor's release notes are forwarded to operations so the patch can be applied during the next scheduled maintenance window.
  • CThe patch is applied first to a single production server during low-traffic hours so that real behaviour can be observed.
  • DThe patch is digitally signed by the vendor and confirmed to address a vulnerability listed on the current scanner report.
Confirm that production patch deployment requires representative testing and a verified rollback, not just vendor metadata or in-production trials. Patches can introduce regressions, compatibility issues, or new defects in business-critical applications. Testing in a representative non-production environment, paired with a verified rollback procedure, allows the organisation to detect breakage before it affects production and to recover quickly if a defect slips through into the live fleet.

Why A is correct: Testing in a like-production environment plus a verified rollback is the standard manager-level safeguard for production patches and is what change management expects before approving deployment.

Why B is wrong: Forwarding release notes is a useful communication step, but it is not a substitute for testing the patch against the application in a representative environment.

Why C is wrong: A canary in production reduces blast radius but still exposes live business workload to an untested change; pre-production testing should come first, with phased production rollout afterwards.

Why D is wrong: Signature validation and tying the patch to a known finding are necessary integrity and relevance checks, but they do not show that the patch will run safely against the application.

See more CISSP practice questions with worked answers.

More in this domain

Back to all Security Operations objectives, or the CISSP cert hub.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.