Exam CISA All QuestionsBrowse all questions from this exam
Question 1250

Which of the following findings would be of GREATEST concern when evaluating an organization's endpoint computer patch management process?

    Correct Answer: A

    The greatest concern when evaluating an organization's endpoint computer patch management process is the frequency of patching. Patching performed every three months is insufficient in today's rapidly evolving threat landscape. Timely updates are crucial to protect against vulnerabilities, and infrequent patching increases the risk of exploitation. Regular, more frequent updates ensure that the organization is protected against the latest security threats, ensuring the security and stability of the endpoint computers.

Discussion
SwallowsOption: C

When evaluating an organization's endpoint computer patch management process, the most concerning outcome is C. Some patches required rollback. The reason being, the need for rollbacks when applying patches indicates problems in several ways: Unexpected problems: The need for rollbacks usually indicates that the application of a patch caused unexpected problems or system instability. This can affect security and system availability. Lack of testing or risk management: The need for rollbacks suggests that the patch was not pre-tested or risk management was not performed properly. If proper testing and evaluation were not performed before applying a patch, future patch applications will be less reliable. Reduced operational efficiency: The need for rollbacks can increase system operation downtime and workload, reducing the operational efficiency of the organization. These factors make the need for rollbacks the most concerning outcome for the security and stability of an organization's endpoint computers.