CISM Practice Question: Arrange the steps for deploying a security patch…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  First identify and assess the patch, then test it in a non-production environment, then backup critical systems and data, then deploy the patch to production, and finally verify the patch installation and system functionality.

  Why this is correct

  This is the correct order because patch management best practices require identifying and assessing the patch, testing it in a safe environment, backing up current systems to enable rollback, deploying the patch, and then verifying successful installation and functionality.

• ✗

  First identify and assess the patch, then backup critical systems, then test the patch in non-production, then deploy, then verify.

  Why it's wrong here

  This is incorrect because testing should occur before backup. Backing up before testing wastes time and resources if the patch fails testing; the backup should reflect the state just before deployment, after the patch has been validated.

• ✗

  First identify and assess the patch, then test, then deploy, then backup, then verify.

  Why it's wrong here

  This is incorrect because deploying without a backup is risky. If the patch causes issues, there is no clean way to revert. Backup must be performed before deployment to ensure recovery.

• ✗

  First identify, then test, then verify, then backup, then deploy.

  Why it's wrong here

  This is incorrect because verification should occur after deployment, not before. Also, backup after verification and before deployment is illogical; backup should immediately precede deployment.

Go deeper

Related to this question