A security analyst is implementing an out-of-band security patch for a critical database cluster following the discovery of an actively exploited zero-day vulnerability. Arrange the following steps of the emergency patch management process in the correct sequential order from first to last.
- 1Validate patch authenticity and execute sandbox testing in a staging environment to assess system compatibility.
- 2Submit an Emergency Change Request (ECR) containing risk assessment details and a rollback plan for approval.
- 3Deploy the patch to the production database cluster using automated configuration management tools.
- 4Perform post-implementation vulnerability scanning and functional health checks to verify threat mitigation.
- 5Update the centralized Configuration Management Database (CMDB) and system security baseline image.
Answer
The correct sequence for emergency patch deployment is: 1) Validate patch authenticity and execute sandbox testing in staging, 2) Submit an Emergency Change Request with a rollback plan, 3) Deploy the patch to the production database cluster, 4) Perform post-implementation vulnerability scanning and health checks, and 5) Update the CMDB and system security baseline image.
The standard emergency patch management lifecycle follows a strict sequence to balance urgent vulnerability mitigation with operational risk management. First, validating and testing the patch in an isolated sandbox ensures it does not destabilize the software ecosystem. Second, submitting an Emergency Change Request (ECR) with a rollback strategy maintains change control governance. Third, the patch is deployed to production systems once approved. Fourth, post-implementation vulnerability scans and service health checks confirm the flaw is resolved without side effects. Finally, updating the CMDB records and baseline images preserves configuration integrity and prevents drift during future node provisioning.
Step-by-Step Solution
Key Concept
Emergency Patch and Configuration Management Lifecycle