CISM Information Security Program Practice Question
During a security assessment, an organization discovers that its patch management process is not consistently applied across all systems. Which of the following controls would best address this deficiency as part of the information security program?
⚠ Common exam trap
It's easy for candidates to choose increased vulnerability scanning (Option B) thinking it solves the patching inconsistency, but scanning only identifies gaps—it does not enforce the actual deployment of patches, which is the core deficiency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a configuration management database (CMDB) linked to an automated patch deployment tool.
A configuration management database (CMDB) provides a centralized, authoritative inventory of all IT assets, including their current patch status. Linking the CMDB to an automated patch deployment tool ensures that patches are consistently and systematically applied to all systems based on their configuration records, directly addressing the inconsistency in the patch management process. This control enforces a standardized, repeatable workflow that eliminates reliance on manual, ad-hoc patching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require all system administrators to manually approve patches before deployment.
Why it's wrong here
Manual approval adds a human gate to every patch, slowing deployment and introducing inconsistency rather than removing it; the deficiency is that patching is not applied uniformly. Manual approval suits high-risk change control on critical systems, where each patch requires documented authorisation before production deployment.
- ✗
Increase the frequency of vulnerability scans to weekly.
Why it's wrong here
Scanning weekly detects unpatched systems sooner but does not remediate them; the deficiency is inconsistent application of patches, not slow detection. Vulnerability scanning suits measuring exposure or validating remediation coverage, so it would be correct where the gap is unknown risk visibility rather than enforcement of the existing patch process.
- ✗
Conduct additional security awareness training for system administrators.
Why it's wrong here
Training addresses administrator knowledge, yet the stem describes a process applied inconsistently, which is an enforcement and accountability gap rather than a skills gap. Awareness training is the right control when assessment shows administrators lack the competence to patch correctly, not when the process itself is not mandated.
- ✓
Implement a configuration management database (CMDB) linked to an automated patch deployment tool.
Why this is correct
A CMDB provides the authoritative inventory linking each system to its patch state, so the automated deployment tool can target every asset rather than relying on inconsistent manual tracking. This directly closes the coverage gap by making patch status auditable and enforcing deployment across all discovered systems.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.