A security administrator is managing the remediation of a critical zero-day vulnerability affecting enterprise database servers. To ensure business continuity and adhere to organizational risk management policies, the administrator must execute the patch management lifecycle in a structured sequence. Arrange the operational steps below in the correct order from first to last.
- 1Analyze vendor advisories and test the security patch within an isolated staging environment to verify system compatibility.
- 2Submit a formal change management request containing testing outcome documentation, risk analysis, and back-out plans for Change Advisory Board approval.
- 3Apply the security patch across production database servers during an authorized maintenance window.
- 4Perform post-installation vulnerability scanning and baseline configuration auditing to confirm patch effectiveness and system integrity.
Answer
The correct operational sequence is: (1) Analyze vendor advisories and test the patch in an isolated staging environment, (2) Submit a formal change management request for Change Advisory Board approval, (3) Apply the patch to production servers during an authorized maintenance window, and (4) Perform post-installation vulnerability scanning and baseline configuration auditing.
The standard enterprise patch management process dictates that security patches must first be tested and validated in a staging environment. Once validated, documentation and back-out plans are submitted for Change Advisory Board review. Following formal authorization, patches are deployed to production systems during designated maintenance windows, after which post-deployment scanning confirms vulnerability closure and baseline compliance.
Step-by-Step Solution
Key Concept
Patch Management and Change Control Lifecycle Procedures