SSCP Security Operations and Administration Practice Question
A patch management process is being audited. Which finding indicates a critical gap in the process?
⚠ Common exam trap
SSCP often tests whether candidates confuse 'documented exceptions' or 'monthly patching' with process gaps — the real gap is skipping pre-production validation, not the cadence or documentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Patches are not tested in a staging environment before production deployment
A patch management process must include testing patches in a staging environment before production deployment to validate compatibility and avoid breaking critical systems. Without staging validation, patches can introduce regressions, incompatibilities, or outages in production. This is a critical gap because it removes the safety net that catches patch-related issues before they impact live operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exception requests for unpatched systems are documented
Why it's wrong here
Documenting exception requests satisfies the audit trail requirement, so it evidences control rather than a gap. The critical gap is the absence of a defined remediation timeline or risk acceptance for unpatched systems. Formal exception handling is correct when compensating controls exist and management has approved the residual risk.
- ✓
Patches are not tested in a staging environment before production deployment
Why this is correct
Deploying untested patches straight to production risks breaking critical systems and forces emergency rollback, so defects escape detection. Staging validation is the control that catches compatibility and regression issues before they affect live services, making its absence a critical process gap.
- ✗
Critical systems are patched monthly
Why it's wrong here
Monthly patching leaves critical systems exposed to exploits for up to thirty days, exceeding typical remediation windows for high-severity vulnerabilities. It is tempting because monthly cycles suit low-risk internal assets where rapid exploitation is unlikely, but critical internet-facing systems demand emergency patching on vendor release.
- ✗
Patches are deployed within 30 days of release
Why it's wrong here
A 30-day deployment window is a defined, measurable remediation timeframe, not a gap. A critical gap would be the absence of any deadline, or patches never applied; meeting a stated SLA indicates the process is functioning.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.