A critical unauthenticated RCE patch is out for an internet-facing server, but the team fears downtime. How do you proceed?

This scenario pits change-management discipline against incident urgency. The senior signal is knowing when a vulnerability is severe enough to override the normal release cadence — and how to do it safely rather than recklessly.

Why urgent-but-controlled is right

An unauthenticated RCE on an internet-facing host is the worst combination: anyone on the internet can run code on your server with no credentials, and these flaws are frequently weaponized into mass-scanning or wormable exploits within hours of disclosure. That justifies emergency change handling. But "urgent" doesn't mean "reckless": test the patch quickly in staging, deploy via an expedited maintenance window or a rolling update that preserves availability, and in the gap apply compensating controls — restrict source IPs, put the service behind a VPN/allowlist, or deploy a WAF/virtual-patch signature. You compress the exposure window without rolling the dice on stability.

Why the distractors are wrong

• Wait for the quarterly window. Rigidly applying routine change cadence to an actively-exploitable RCE leaves a critical hole open for weeks. Process exists to manage risk, not to manufacture it.
• Patch directly in production, no testing, business hours. The mirror-image failure: now you've swapped a security risk for an availability risk. An untested patch can break the app, and a mid-day failure with no rollback plan turns one incident into two.
• Ignore it — the firewall will protect the server. The firewall is allowing the traffic to this exposed service; that's its job. A perimeter device doesn't stop exploitation of a port you've deliberately opened, and the exploit needs no authentication to pass through.

What the interviewer is probing

They want risk-based prioritization, not dogma. Strong candidates explicitly weigh exploitability and exposure, reach for compensating controls to buy time, and still insist on a tested, staged rollout. The hallmark is balancing the two failure modes — too slow and too sloppy — and landing in the middle.