When a security vulnerability is discovered, what sequence of actions is recommended?

• A. Ignore until customer reports
• B. Triage, patch promptly, communicate risk to stakeholders, and verify fixes via tests and reviews
• C. Patch and redeploy without testing
• D. Notify none of stakeholders

Answer: (C)

A disciplined vulnerability remediation process starts with triage to understand how severe the issue is and which systems are affected, then patch promptly to reduce the exposure window, communicate the risk and plan to stakeholders so everyone knows what’s happening, and finally verify the fix through testing and, if appropriate, code reviews before redeploying. This sequence ensures the vulnerability is addressed quickly while confirming that the patch truly resolves the issue and doesn’t introduce new problems. Skipping testing and verification, or redeploying without validation, can leave the vulnerability not fully resolved and may cause unintended side effects or regressions.