Exam CAS-004 All QuestionsBrowse all questions from this exam
Go to Exam
Question 402

A hospital has fallen behind with patching known vulnerabilities due to concerns that patches may cause disruptions in the availability of data and impact patient care. The hospital does not have a tracking solution in place to audit whether systems have been updated or to track the length of time between notification of the weakness and patch completion. Since tracking is not in place, the hospital lacks accountability with regard to who is responsible for these activities and the timeline of patching efforts. Which of the following should the hospital do first to mitigate this risk?

    Correct Answer: A

    The first step the hospital should take to mitigate the risk is to complete a vulnerability analysis. This process will provide a comprehensive understanding of the existing vulnerabilities within the hospital's systems and identify the critical areas that need immediate attention. It will help prioritize the patching process based on the severity of the vulnerabilities, which is essential for minimizing disruptions to patient care. A clear understanding of vulnerabilities allows the hospital to make informed decisions on subsequent actions, such as implementing a ticketing system, obtaining guidance, or ensuring CVEs are current.

Discussion
pego99Option: A

The hospital should complete a vulnerability analysis I think. The question asks which should be done first to mitigate this risk; a vulnerability analysis would outline the most pressing issues that need to be fixed. After that, a ticketing system could be put in place.

23169fdOption: A

Understanding the Scope: A vulnerability analysis will provide a comprehensive understanding of the existing vulnerabilities within the hospital's systems. It identifies the critical areas that need immediate attention and helps prioritize the patching process based on the severity of the vulnerabilities. Informed Decision-Making: With a detailed vulnerability analysis, the hospital can make informed decisions about which patches need to be applied urgently and which can be scheduled for later, thereby minimizing disruptions to patient care. Foundation for Other Actions: Once the vulnerabilities are clearly identified and documented, the hospital can then implement other necessary steps, such as obtaining guidance from the health ISAC, purchasing a ticketing system, ensuring CVEs are current, and training administrators. These actions will be more effective and targeted when backed by the data from the vulnerability analysis

cf13076Option: C

To mitigate this risk as per the CompTIA CASP+ certification, the hospital should first: C. Purchase a ticketing system for auditing efforts. Implementing a ticketing system will provide a centralized solution for tracking and monitoring patching activities. It will help in creating accountability by assigning responsibilities for patching tasks, tracking the progress of patch implementations, and ensuring timely completion of patching efforts. A ticketing system can help streamline the patch management process and improve the overall security posture of the hospital's IT systems.