ITPEC FE Subject B October 2025 Question 18

The incident: a critical CMS plugin had a known, publicly exploited vulnerability for months, but patching was delayed due to a 6-month update cycle and ongoing compatibility testing.

Blank A — revised patch management rule:
The new rule should prioritize patches for vulnerabilities with publicly confirmed exploitation methods, applying them within one week. This is realistic given the 3-day compatibility testing constraint and limited staff, unlike "patch everything in 3 days" which is infeasible.

• •Options (a)/(b) fail because applying patches to all components within 3 days is unrealistic — compatibility testing alone takes 3 days per component, and parallel testing isn't possible
• •Options (e)/(f) describe post-patch verification, not a patch management rule

Blank B — interim protective measure:
A Web Application Firewall (WAF) protects the web application at Layer 7 during the gap between vulnerability disclosure and patch application. The existing packet filtering firewall (ports 80/443) only filters by port/IP, not by request content.

• •"Disabling affected components" is too disruptive — the scenario states the plugin was critical to the functioning of the e-commerce website

Why not others:
- (a) A: unrealistic timeline for all components; B: disabling a critical plugin breaks the site
- (b) A: same unrealistic timeline; B: WAF is correct but paired with wrong A
- (c) A: correct prioritization approach; B: disabling critical components is too disruptive
- (e) A: vulnerability scanning is verification, not a patching rule; B: disabling is disruptive
- (f) A: same verification issue; B: WAF is correct but paired with wrong A

Key rule: when a vulnerability has a known public exploit, prioritize patching it urgently (risk-based approach), and use a WAF as an interim Layer 7 defense while patches undergo testing.

AI-generated — may contain errors