Which vulnerable devices should be patched first?
The team has five hours of patch capacity. A scan reports twenty affected devices.
The question
Larkspur Systems and the device inventory are fictional. No active exploitation is known yet. All affected devices have the same supported patch. One engineer patches sequentially at four devices per hour, including verification; no parallel work or interruption is assumed.
| Devices | |
|---|---|
| Vulnerable public gateways | 8 |
| Vulnerable internal appliances | 12 |
| Not affected | 20 |
All 40 devices have an owner. Public gateways are reachable from the internet; internal appliances are not.
Confirmed active exploitation takes priority. Otherwise, patch reachable public devices before internal devices. Any isolation must be verified and must retain a patch-and-reopen owner.
“Choose your next action and explain the evidence behind it.”
Not saved by this site. Your browser may restore text when you navigate back.
A strong answer, step by step
Open each step in turn. This is one strong answer, not the only one.
Step 1: Which facts set the order?
What would you do here? Open the move you’d make.
Start with verified public exposure
The strong move. Exposure and observed exploitation matter to this policy.
Sort only by the number of devices in each group.
Tempting, but it misses something. Group size does not describe attack reachability.
See how a strong candidate says it
“Start with the eight reachable public gateways, while checking for active exploitation and validating the inventory.”
Why it works: Exposure and observed exploitation matter to this policy.
Step 2: What schedule fits?
What would you do here? Open the move you’d make.
Show the five-hour patch plan
The strong move. The rate includes verification, so no patch time is omitted.
Promise to patch all forty devices in five hours.
Tempting, but it misses something. Only twenty need this patch, and forty would take ten hours.
See how a strong candidate says it
“The eight public devices take two hours and the twelve internal devices take three. The full twenty-device plan uses five hours.”
Why it works: The rate includes verification, so no patch time is omitted.
Step 3: How does isolation change the order?
The incident owner verifies a deny rule isolating two of the eight public gateways. No new route reaches them. The other six public gateways and all twelve internal appliances are unchanged.
What would you do here? Open the move you’d make.
Reduce exposure without dropping the patch
The strong move. Verified isolation reduces current exposure but does not remove the vulnerable software.
Remove the two isolated devices from remediation.
Tempting, but it misses something. They are still affected and can become reachable again.
See how a strong candidate says it
“Patch the six still-reachable public devices first: 1.5 hours. Keep the two isolated gateways on the patch list before reopening them.”
Why it works: Verified isolation reduces current exposure but does not remove the vulnerable software.
Step 4: When is the work closed?
What would you do here? Open the move you’d make.
Verify patching and reopening
The strong move. Containment and permanent remediation are separate states.
Close the programme when the six public devices are done.
Tempting, but it misses something. Fourteen affected devices would still lack a permanent fix.
See how a strong candidate says it
“Require verified patch results for all twenty affected devices and a deliberate reopening check for the isolated pair.”
Why it works: Containment and permanent remediation are separate states.
The answer, in short
- Decision
- Patch the reachable gateways first and retain all twenty affected devices in the plan.
- Because
- Isolation changes the order, not the need for a permanent fix.
- What would change it
- New active-exploitation evidence or changed reachability would change the order.
Common traps
- Isolation is not a patch.
- An inventory count is not a risk score.
Check your answer
- I used the stated priority policy.
- I included verification time.
- I kept isolated devices on the list.
- I named the reopening check.
Last reviewed Nov 10, 2026