CS0-003 Vulnerability Management Practice Question
A security team is implementing a patch management process for a large enterprise. They must ensure that patches are tested before deployment to production. The team has a staging environment that mirrors production. During patch testing, they discover that a critical security patch for a database server causes a performance degradation of 30% in a key application. What should the team do next?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Contact the vendor for a fix or workaround, and implement compensating controls in the meantime.
The patch is critical but causes performance issues. The best approach is to work with the vendor for a resolution or apply compensating controls until a fix is available. Applying the patch blindly may disrupt operations, while skipping it leaves the vulnerability unaddressed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Skip the patch and rely on existing security controls.
Why it's wrong here
Abandoning the patch entirely leaves the critical vulnerability fully exploitable indefinitely; existing controls were presumably already in place before the patch was released and clearly were not sufficient to justify accepting a critical-severity exposure without any additional mitigation or vendor engagement.
- ✗
Apply the patch to production immediately because it fixes a critical vulnerability.
Why it's wrong here
Pushing straight to production after staging revealed a 30 percent performance hit ignores the very purpose of the staging environment; deploying a known-degrading patch risks SLA violations, application timeouts, or outages for the key application, trading one confirmed operational failure for an unconfirmed security one.
- ✓
Contact the vendor for a fix or workaround, and implement compensating controls in the meantime.
Why this is correct
Engaging the vendor for a hotfix or documented workaround while layering compensating controls, such as WAF rules, enhanced monitoring, or restricted access, addresses the vulnerability's risk in the interim without forcing the team to accept either the security exposure or the measured performance degradation.
- ✗
Deploy the patch to a subset of production servers to test performance.
Why it's wrong here
Rolling the patch out to only some production database servers still injects the same 30 percent degradation onto whichever users hit those instances, and it fragments the environment into inconsistent patch states without resolving the underlying performance conflict identified during staging tests.
Go deeper
Related to this question
Learn chapter
Vulnerability Management Workflow
Key term
Quality update policy
A quality update policy is a set of rules and schedules that IT administrators use to control which Windows updates are deployed to devices to ensure stability, security, and compatibility.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.