Study. uk . com
  1. Home
  2. All questions
  3. Question 423

CISSP study material · question 423 of 500

Two patches are available: one closes a critical flaw on internet-facing servers, the other a minor flaw on three test machines. On what basis does NIST SP 800-40 Rev. 4 say to order them?

  1. By how much cybersecurity risk each deployment removes.
  2. By the age of the vulnerability each addresses.
  3. By the size of the maintenance window each requires.
  4. By the vendor's own severity rating, which must be followed.
Show the answer

Answer: A. By how much cybersecurity risk each deployment removes.

A patch outranks others where deploying it removes more cybersecurity risk, and falls behind where it fixes a low-risk flaw on few unimportant assets.

Source: NIST SP 800-40 Rev. 4 (NIST) — SP 800-40 Rev. 4 > 2.3.1 Prepare to Deploy the Patch

Challenge yourself on this topic → Study as cards