CISM Information Security Program Practice Question
During a security assessment, an organization discovers that its patch management process is not consistently applied across all systems. Which of the following controls would best address this deficiency as part of the information security program?
⚠ Common exam trap
It's easy for candidates to choose increased vulnerability scanning (Option B) thinking it solves the patching inconsistency, but scanning only identifies gaps—it does not enforce the actual deployment of patches, which is the core deficiency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a configuration management database (CMDB) linked to an automated patch deployment tool.
A configuration management database (CMDB) provides a centralized, authoritative inventory of all IT assets, including their current patch status. Linking the CMDB to an automated patch deployment tool ensures that patches are consistently and systematically applied to all systems based on their configuration records, directly addressing the inconsistency in the patch management process. This control enforces a standardized, repeatable workflow that eliminates reliance on manual, ad-hoc patching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require all system administrators to manually approve patches before deployment.
Why it's wrong here
Manual approval adds delay and inconsistency.
- ✗
Increase the frequency of vulnerability scans to weekly.
Why it's wrong here
Scans identify vulnerabilities but do not apply patches.
- ✗
Conduct additional security awareness training for system administrators.
Why it's wrong here
Training does not directly address the process deficiency.
- ✓
Implement a configuration management database (CMDB) linked to an automated patch deployment tool.
Why this is correct
CMDB provides system inventory; automation ensures consistent patching.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.