Vulnerability and Patch Management: Quiz 2 (Modules 2-4 Inclusive)

Remediation

The process of addressing vulnerabilities in order to reduce risk through patching, configuration changes, or compensating controls.

Patching

A software update designed to correct defects, address security vulnerabilities, or enhance functionality.

Configuration Changes

Reducing risk by modifying system settings (like disabling a vulnerable feature or restricting permissions) rather than altering the software itself.

Compensating Controls

Alternative safeguards implemented (such as firewall rules, network segmentation, or increased access controls) to limit exposure when patching is not feasible.

Security Patches

Patches that address known vulnerabilities and are often required to meet regulatory or compliance obligations.

Feature Patches

Patches that introduce new functionality or enhancements and require thorough testing.

Emergency Patches

Patches released rapidly in response to actively exploited vulnerabilities or zero-day threats.

CVSS (Common Vulnerability Scoring System)

A numerical score from 0 to 10 indicating the technical severity of a vulnerability.

EPSS (Exploit Prediction Scoring System)

A probability score expressed as a percentage (0 to 100%) indicating how likely a vulnerability is to be exploited in the wild.

Maintenance Windows

Scheduled periods designed to minimize user impact and ensure support staff availability for applying routine patches.

Canary Releases

A limited production deployment strategy where patches are rolled out to a small subset of users or systems to monitor behavior before full deployment.

Phased Rollout

A deployment strategy where updates are applied incrementally across groups of devices, making it easier to pause if something breaks.

Big-Bang Deployment

A deployment strategy where all systems are updated simultaneously, which is fast and simple but carries higher risk of downtime.

WSUS (Windows Server Update Services)

A basic Windows-only patch management tool for approving and scheduling updates.

SCCM (Microsoft Configuration Manager)

An enterprise-scale tool supporting patching, software deployment, and configuration management for large environments.

Ansible

A declarative, script-driven automation tool commonly used in Linux, cloud, and DevOps environments for flexible patching.

Rollback Plan

The process of undoing a patch or update (such as restoring a VM snapshot or reverting to a previous software version) if it causes problems.

Contingency Plan

Alternative operational measures and plans prepared to keep the business running if a patch fails or causes an outage.

SLA (Service Level Agreement)

Agreements that define required remediation timelines and maximum allowable timeframes for resolving vulnerabilities based on risk.

Risk Acceptance

A formal agreement by leadership to accept the risk of leaving a specific vulnerability unpatched due to business constraints.

Exception (Patch Exception)

A formal record and approval stating that a patch cannot or should not be applied at a given time, complete with mitigating controls and an expiration date.

Vulnerability Assessment

The systematic process of identifying, classifying, and prioritizing weaknesses in systems, applications, and networks.

False Positive

A scan result that incorrectly flags a non-issue as a vulnerability, requiring manual cross-verification.

Residual Risk

The risk that remains after security controls, fixes, or remediation measures have been applied.

Validation

The process of confirming that remediation (such as patching or configuration changes) has successfully mitigated vulnerabilities.Remediation

Patching

A software update designed to correct defects, address security vulnerabilities, or enhance functionality.

Configuration Changes

Reducing risk by modifying system settings (like disabling a vulnerable feature or restricting permissions) rather than altering the software itself.

Compensating Controls

Alternative safeguards implemented (such as firewall rules, network segmentation, or increased access controls) to limit exposure when patching is not feasible.

Security Patches

Patches that address known vulnerabilities and are often required to meet regulatory or compliance obligations.

Feature Patches

Patches that introduce new functionality or enhancements and require thorough testing.

Emergency Patches

Patches released rapidly in response to actively exploited vulnerabilities or zero-day threats.

CVSS (Common Vulnerability Scoring System)

A numerical score from 0 to 10 indicating the technical severity of a vulnerability.

EPSS (Exploit Prediction Scoring System)

A probability score expressed as a percentage (0 to 100%) indicating how likely a vulnerability is to be exploited in the wild.

Maintenance Windows

Scheduled periods designed to minimize user impact and ensure support staff availability for applying routine patches.

Canary Releases

A limited production deployment strategy where patches are rolled out to a small subset of users or systems to monitor behavior before full deployment.

Phased Rollout

A deployment strategy where updates are applied incrementally across groups of devices, making it easier to pause if something breaks.

Big-Bang Deployment

A deployment strategy where all systems are updated simultaneously, which is fast and simple but carries higher risk of downtime.

WSUS (Windows Server Update Services)

A basic Windows-only patch management tool for approving and scheduling updates.

SCCM (Microsoft Configuration Manager)

An enterprise-scale tool supporting patching, software deployment, and configuration management for large environments.

Ansible

A declarative, script-driven automation tool commonly used in Linux, cloud, and DevOps environments for flexible patching.

Rollback Plan

The process of undoing a patch or update (such as restoring a VM snapshot or reverting to a previous software version) if it causes problems.

Contingency Plan

Alternative operational measures and plans prepared to keep the business running if a patch fails or causes an outage.

SLA (Service Level Agreement)

Agreements that define required remediation timelines and maximum allowable timeframes for resolving vulnerabilities based on risk.

Risk Acceptance

A formal agreement by leadership to accept the risk of leaving a specific vulnerability unpatched due to business constraints.

Exception (Patch Exception)

A formal record and approval stating that a patch cannot or should not be applied at a given time, complete with mitigating controls and an expiration date.

Vulnerability Assessment

The systematic process of identifying, classifying, and prioritizing weaknesses in systems, applications, and networks.

False Positive

A scan result that incorrectly flags a non-issue as a vulnerability, requiring manual cross-verification.

Residual Risk

The risk that remains after security controls, fixes, or remediation measures have been applied.

Validation

The process of confirming that remediation (such as patching or configuration changes) has successfully mitigated vulnerabilities.

Point-in-Time Scan

A one-time vulnerability scan conducted at a specific moment, such as before a major merger.

Continuous Scanning

Ongoing, automated vulnerability monitoring ideal for dynamic cloud or enterprise environments.

Shadow IT

Un-inventoried endpoints, unauthorized applications, or unmanaged assets introduced outside of formal IT oversight.

OWASP Top 10

An industry-standard awareness document that represents the most critical security risks to web applications.

Point-in-Time Scan

A one-time vulnerability scan conducted at a specific moment, such as before a major merger.

Continuous Scanning

Ongoing, automated vulnerability monitoring ideal for dynamic cloud or enterprise environments.

Shadow IT

Un-inventoried endpoints, unauthorized applications, or unmanaged assets introduced outside of formal IT oversight.

OWASP Top 10

An industry-standard awareness document that represents the most critical security risks to web applications.