ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Your team manages a fleet of Linux web servers running in an IaaS cloud auto-scaling group that can add and remove instances at any time. A critical kernel vulnerability has been announced. To keep the fleet compliant with corporate baseline requirements while avoiding service downtime, which patch-management strategy should you implement first?

Create a new hardened machine image that contains the kernel patch and perform a rolling replacement of all instances in the auto-scaling group.
Rely on the cloud provider's host-level patching; no action is needed because the underlying hypervisor will be updated automatically.
Open an emergency maintenance window, SSH to every running instance, run the package manager to install the patch, and then reboot each server in sequence.
Temporarily raise the auto-scaling group's maximum size, run a remote patching script on the original instances, and then scale back down when finished.

Report Issue

Answer Description

In an elastic IaaS environment the preferred way to apply operating-system patches is to follow an immutable infrastructure pattern:

Build a new golden image (for example, a new AMI in AWS or a managed image in Azure) that already includes the approved kernel patch.
Use the auto-scaling or deployment service to perform a rolling replacement, gradually launching the new, patched instances and terminating the old ones.
This method keeps every instance at a known, validated state, supports automated compliance scanning before release, and eliminates the risk and downtime associated with in-place patching.
Connecting to each live instance to run package updates or running scripts against pets instead of cattle increases operational effort and leaves room for configuration drift. Simply enabling IDS does not remediate the vulnerability, and temporarily increasing capacity while patching in place still exposes customers to risk during the process.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.