Question

A vulnerability analyst has identified a critical CVE affecting the company's customer-facing ERP application. The vendor has released a patch. Before deploying the patch to the production environment, the change advisory board requires the analyst to reduce the risk of the patch causing an outage or breaking application functionality. Which action should the analyst recommend FIRST to address this concern?

Accepted Answer

Apply the patch in a staging environment that mirrors production and validate application functionality before scheduling the production rollout

Answer

Deploy the patch directly to production during a maintenance window since the CVE is critical and speed matters most

Answer

Implement a firewall rule to block traffic to the affected service and defer patching indefinitely

Answer

Accept the risk formally and document the decision without applying the patch