A security operations team is preparing to remediate a newly disclosed critical vulnerability affecting enterprise application servers. In what order should the team execute the patch management lifecycle steps from first to last?
- 1Validate and test the patch in an isolated non-production staging environment to verify functionality and document roll-back procedures.
- 2Submit a formal change request detailing risk assessment, test results, and deployment schedules to the Change Advisory Board (CAB) for approval.
- 3Deploy the patch to the production server cluster during the authorized maintenance window.
- 4Perform post-patch vulnerability scanning and configuration baseline auditing to confirm successful remediation and posture integrity.
Answer
The correct operational sequence begins with testing the patch in a non-production staging environment, followed by submitting a formal change request to the Change Advisory Board, deploying the patch to production during the approved maintenance window, and concluding with post-deployment auditing and verification scanning.
Effective patch and configuration management follows a structured lifecycle: evaluating and testing patches in non-production environments first, securing formal approval from the Change Advisory Board, deploying updates during authorized windows, and performing post-implementation auditing to verify that vulnerability remediation was successful and configuration baselines remain intact.
Step-by-Step Solution
Key Concept
Patch Management Lifecycle and Change Control Governance