A rushed admin wants to push every available patch to all county cloud hosts tonight without reviewing findings. Why is that approach poor vulnerability management?
Select an answer to reveal the explanation.
Short Explanation
Dumping every patch at once is like replacing every pipe in city hall overnight with no blueprint—expect floods. Identify, assess, then remediate in order so you fix what matters without breaking citizen services.
Full Explanation
Vulnerability management is a sequenced process: identify and assess before changing production at scale. Pushing every available patch to all county cloud hosts tonight without reviewing findings risks outages, skips true priorities, and may still miss critical exposed issues that needed emergency focus. Blind mass change is poor practice for civic platforms that residents depend on daily.
Patches should not be applied only annually—that is the opposite extreme. Uninstalling vulnerability scanners before patching removes identification and verification. Assessment is not illegal in public-sector clouds; it is expected due diligence.
Exam caveat: emergency mass patching can occur for active exploits, but even then change control, testing where feasible, and prioritization still apply. "Assess then remediate" is the exam baseline narrative.
Operational check: review the current scan queue, select patches by risk, test on a pilot ring, schedule a controlled rollout with monitoring, and verify clearance of targeted CVEs. Document why any deferred patches remain open on county hosts.
County change management should require a short risk note naming which CVEs the night’s patches actually target, so “install everything” waves cannot bypass prioritization while resident-facing hosts absorb untested change risk.