Exam CDPSE topic 1 question 217 discussion

I would go with A on this one. Applying OS patching immediately is the most effective and direct action to manage privacy risk related to a significant vulnerability. Patching addresses the specific security flaw, thereby reducing the risk of exploitation and protecting sensitive customer data stored in the CRM system. Performing a vulnerability assessment to determine the impact is a good practice, but in the case of a significant vulnerability that has already been identified, immediate action (such as patching) is more critical to minimize risk.

It's definitely not B. Initially, I wanted to say A - apply the patching, but D - Perform a vulnerability assessment to determine the impact makes the most sense since it will most likely result in an emergency change ticket to apply the OS patch, based on the severity.