Critical CVEs are announced for guest operating systems used by a county's cloud VM images. What lifecycle action should operations take promptly?
Select an answer to reveal the explanation.
Short Explanation
Leaving known holes in the guest OS is like ignoring a recall notice on the city fleet. Patching is routine lifecycle care, not a once-a-year ceremony.
Full Explanation
Patch management is a core cloud resource lifecycle activity. Critical vulnerabilities in guest operating systems on a county’s cloud VM images require prompt application of vendor patches so newly launched and existing workloads do not remain exposed. Treating guest OS patching as lifecycle hygiene protects resident-facing services and reduces exploit windows on public infrastructure.
Freezing all images permanently so patch levels never change again guarantees accumulating risk. Ignoring guest OS patches because only hypervisor firmware matters misunderstands shared responsibility—guest OS security remains the customer’s duty in IaaS. Waiting until annual hardware refresh before applying vendor fixes leaves critical CVEs open for months.
Exam caveat: patching guest OS images and patching running instances are related but distinct lifecycle steps; golden-image refresh plus instance remediation are often both required. Critical/emergency patches may bypass normal monthly cadences.
Operational check: inventory affected images and running VMs, apply vendor fixes in non-prod first, refresh golden images, roll production during an approved window, and verify with vulnerability scans. Track CVE closure evidence for county security reporting.