mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: Has a policy that all servers must have security…
An organization has a policy that all servers must have security patches applied within 30 days of release. Which of the following is the best practice for patching?
⚠ Common exam trap
ISC2 often tests the misconception that 'all patches must be applied immediately' or that 'critical patches are the only priority,' but the trap here is that candidates overlook the necessity of a controlled testing phase to prevent production outages, even when a strict 30-day deadline exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Test patches in a non-production environment before deploying to production
Testing patches in a non-production environment first allows the organization to identify compatibility issues, performance regressions, or conflicts with existing software before risking production systems. This aligns with the change management principle of validating changes in a controlled setting, ensuring that the 30-day patching deadline can be met without introducing instability. Skipping testing (A) or applying patches simultaneously (B) could lead to widespread outages, while only applying critical patches (D) would leave the organization exposed to non-critical vulnerabilities that could be chained in an attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Skip patches that have not been widely tested
Why it's wrong here
Skipping patches leaves vulnerabilities unaddressed.
- ✗
Apply patches to all servers simultaneously
Why it's wrong here
Simultaneous patching can cause widespread outages if patches cause problems.
- ✓
Test patches in a non-production environment before deploying to production
Why this is correct
Testing validates patches without impacting production services.
- ✗
Only apply critical patches
Why it's wrong here
This ignores important patches that may be necessary for security.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Change management
Change management is the structured process of planning, approving, implementing, and reviewing changes to IT systems to minimize risk and disruption.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.