Question

A vendor releases a security patch for a high-severity vulnerability affecting the ERP application servers that support the company's order-processing business. The vulnerability is not yet known to be exploited in the wild, and it requires authenticated local access to trigger. The application team is concerned that past patches have broken custom integrations, causing production outages. As the SOC analyst advising on remediation, what is the most appropriate patching recommendation?

Accepted Answer

Test the patch in a staging environment that mirrors production, then schedule deployment during an approved maintenance window with a validated rollback plan

Answer

Deploy the patch immediately to all production ERP servers during business hours to close the exposure as fast as possible

Answer

Skip the patch and rely solely on network segmentation, since the vulnerability requires local access

Answer

Wait until the vulnerability is confirmed to be actively exploited before applying any remediation