A database vendor releases a security patch that fixes a remotely exploitable vulnerability in the engine version running in production. The organization has development, test and production environments and a monthly maintenance window. What is the best approach?
Select an answer to reveal the explanation.
Short Explanation
Patching is like changing a tire: you don't do it at full speed on the highway, and you check the spare before you start. Test the patch in non-production, back up, apply in an approved window and confirm everything runs. Urgency can shorten the wait for that window, but it never means skipping the test and the backup.
Full Explanation
Patch management balances risk from the vulnerability against risk from the change. The standard process is to review the release notes, apply the patch to a non-production environment and run regression tests against representative workloads, take a verified backup of production, schedule the change through change approval in a maintenance window, apply the patch, and verify service health afterward, with a documented rollback plan. For a severe, remotely exploitable flaw, the organization may use an expedited or emergency change rather than waiting for the monthly window, but testing and a backup remain part of the process. Patching production during business hours without testing risks an outage at the worst time and leaves no validated rollback point. Deferring a security fix until the next major upgrade leaves a known exploitable vulnerability in place for an extended period, which is precisely the exposure patching is meant to close. Applying to production before test reverses the purpose of a test environment; problems would be discovered by users rather than by testers. Exam caveat: interim mitigations such as restricting network access to the listener can reduce risk while the patch moves through testing, but they do not replace the patch. Operational check: record the engine version before and after, run post-patch smoke tests and key queries, compare performance with the baseline, and close the change record with results.