ITPEC FE Subject B October 2025 Question 18
From the answer group below, select the most appropriate combination of answers to be inserted into A and B in the description.
Company Q is a mid-sized online retailer selling a wide range of daily necessities to a large number of general consumers. Customers are required to create an account and log in to the company’s e-commerce website to make purchases. The e-commerce website is constructed using an open-source content management system (CMS) with various plugins. It is hosted on the company’s on-premise web servers located in the Demilitarized Zone (DMZ). Customer data is stored in the database installed on the web server as well. Since the e-commerce site received orders from many customers, availability of the e-commerce website is critical, and the maximum tolerable downtime (MTD) is limited to one hour per week.
The server is protected by a packet filtering firewall that permits access only through ports 80 and 443. Mr. K is an administrator responsible for both the operations and security of the company’s e-commerce website. He maintains the configuration of the firewall and other security measures as well as patch management. For patching the company’s e-commerce website, compatibility testing is important to maintain website stability. It takes at least three days to complete compatibility testing for one component. Due to limited human resource, it is unrealistic to perform compatibility tests in parallel and finish them quickly. Therefore, the patch management rule is to apply patches for the web server’s OS and the core CMS components within a week of their release, while updates for other components including plugins are scheduled to be applied within six months. Patches for the web server’s OS and the core CMS components are released on a monthly basis, while updates for other components including plugins are released each month as well.
One day, Company Q’s e-commerce website was compromised and the database on the webserver was accessed by an unauthorized third party. The investigation revealed that this was caused by an unpatched vulnerability in a plugin enabled on the CMS. This plug-in was critical to the functioning of the e-commerce website. The latest version of the plugin, which includes a fix for this vulnerability, was released by the vendor three months ago. The exploitation of this vulnerability has been reported publicly since last month. Company Q was still conducting compatibility testing, and the update to the latest version was scheduled for a later time.
To prevent similar incidents from occurring, Mr. K is required to revise the patch management rules for Q’s e-commerce website. In consideration of the workload associated with compatibility testing, Mr. K proposed updating the patch management rule for the e-commerce website to A. Furthermore, as a protective measure to prevent the servers from exploitation during the interim period before patches are applied, Mr. K proposed B.
Answer group
Explanation
A: prioritize patches for vulnerabilities with public exploits, within a week of confirmation; B: a web application firewall — patch what is being attacked first, and filter attacks in the web traffic while the patch is tested.
Blank A: the old rule gave plugins six months, so a fix released three months earlier was still in testing when attacks on it had been public for a month. The new rule must shorten the wait for dangerous patches without exceeding what one administrator can test: at least three days per component, one component at a time, with OS, CMS and plugin updates arriving every month. Patching exploited vulnerabilities first, within one week of the exploit being confirmed, fits that capacity and closes exactly the gap that was attacked.
Blank B: the plugin is critical to the site and the MTD is one hour per week, so the interim measure must keep the site running. The packet-filtering firewall already allows ports 80 and 443, which is where the attack arrives. A WAF inspects the content of HTTP and HTTPS requests and can block exploit attempts against the unpatched plugin until the patch is applied.
Answer (d)
Why not others:
- •(a) and (b) — patching every component within three days is impossible when a single compatibility test takes at least three days and tests cannot run in parallel
- •(e) and (f) — a scan after patching only verifies patches already applied; it does nothing about the long delay before a patch is applied, which is what let the attack happen
- •(c) — disabling the vulnerable plugin takes down a component the site depends on, stopping sales for far longer than the one-hour MTD
Key rule: Patch management is risk-based: with limited testing capacity, apply first the patches for vulnerabilities that are actively exploited, and use a compensating control such as a WAF during the testing window.
Security Scenarios · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.