Patch management

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes patch management?

A A regular, planned process of finding, testing and installing updates that fix known vulnerabilities

B Installing an update only after a system has already been attacked

2. A patch has just been released for the web framework your team uses. What should happen first?

A Install it straight onto the production server

B Test the patch in a testing environment before release

3. Which is a good approach to scheduling updates?

A Apply patches randomly whenever someone remembers

B Set a regular patching schedule and apply urgent security fixes as soon as they are tested

4. Which statement about patching is true?

A Libraries and frameworks used in a project need patching as well as the operating system

B Only the operating system ever needs patching

5. Why does a team keep a list of the software and versions it has installed?

A So it knows which systems and components need a patch when a vulnerability is announced

B So it can skip patching versions that have been installed for a long time

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1npm audit		Aschedule_patching("Tuesday", "02:00")
2pip list --outdated		BShows which installed packages have newer versions, helping track what is installed and what needs patching
3Patches are tested in a separate environment before they are released to production		CChecks a project's libraries and frameworks for known vulnerabilities so patches can be planned
4Updates are scheduled at regular times to keep patching planned and predictable		DThe patch is installed straight onto production without being tested first, so it could break the software or cause downtime.
5install_patch("production") # no testing done		Edeploy(patch, "testing") if tests_pass: deploy(patch, "production")
6inventory = [] # patch only when someone remembers		FThere is no record of installed software and versions, so the team cannot know what needs patching and some vulnerable software will be missed.

Definitions

patch management

Fill in the Blanks

Complete each line of code by filling in the missing parts.

pip ____ --outdated

pip install --_______ requests

IF result = "pass" THEN ______(patch)

IF today = _________ THEN install_updates()

npm _____

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A installed = '2.1'

B latest = '2.4'

C needs_patch = False

D if installed == latest:

E needs_patch = True

Question 2

A patch = download('v1.2.1')

B apply(patch, test_server)

C passed = run_tests()

D if not passed:

E apply(patch, live_server)

Question 3

A day = 'Tue'

B hour = 2

C if day = 'Tue' and hour < 5:

D install_updates()

Question 4

A libs = ['flask', 'numpy']

B for lib of libs:

C update(lib)

D run_tests()

Question 5

A inventory = {}

B inventory['flask'] == '2.3.1'

C inventory['numpy'] = '1.26'

D print(len(inventory))

Answer Key

Patch management

Section A: Quick Questions

A — A regular, planned process of finding, testing and installing updates that fix known vulnerabilities

B — Test the patch in a testing environment before release

B — Set a regular patching schedule and apply urgent security fixes as soon as they are tested

A — Libraries and frameworks used in a project need patching as well as the operating system

A — So it knows which systems and components need a patch when a vulnerability is announced

Section B: Match the Pairs

npm audit → Checks a project's libraries and frameworks for known vulnerabilities so patches can be planned

pip list --outdated → Shows which installed packages have newer versions, helping track what is installed and what needs patching

Patches are tested in a separate environment before they are released to production → deploy(patch, "testing") if tests_pass: deploy(patch, "production")

Updates are scheduled at regular times to keep patching planned and predictable → schedule_patching("Tuesday", "02:00")

install_patch("production") # no testing done → The patch is installed straight onto production without being tested first, so it could break the software or cause downtime.

inventory = [] # patch only when someone remembers → There is no record of installed software and versions, so the team cannot know what needs patching and some vulnerable software will be missed.

Section C: Definitions

patch management — The regular, planned process of finding, testing and installing updates that fix known vulnerabilities in software, including libraries and frameworks.

Section D: Fill in the Blanks

pip list --outdated

pip install --upgrade requests

IF result = "pass" THEN deploy(patch)

IF today = patch_day THEN install_updates()

npm audit

Section E: Spot the Error

D — A library needs patching when the installed version is different from the latest version. The condition should use != so needs_patch becomes True when the versions differ.

D — A patch should only be released to the live server if the tests passed. The line should be if passed: so that failing patches are not released.

C — The scheduled update window is checked with a comparison. Comparing needs == rather than =, which is assignment. It should be if day == 'Tue' and hour < 5:

B — Python loops use the keyword in, not of. The line should be for lib in libs: so every library in the list is patched.

B — Recording the installed version needs assignment with a single =. Using == only compares, so nothing is stored. It should be inventory['flask'] = '2.3.1'