mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A company uses a mix of Windows and Linux servers
A company uses a mix of Windows and Linux servers. The vulnerability scanner reports a critical remote code execution vulnerability in Apache Struts (CVE-2017-5638) on a web server located in the DMZ. This server is behind a load balancer with an identical twin server that does not appear vulnerable. The security team needs to implement immediate remediation while minimizing downtime. What should the analyst do?
⚠ Common exam trap
It's easy for candidates to choose immediate patching (Option D) without considering the requirement to minimize downtime, or they may choose shutdown (Option C) thinking it's the safest, but the scenario explicitly prioritizes uptime over a full patch cycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a virtual patch via web application firewall (WAF) rules
Implementing a virtual patch via WAF rules can immediately block exploitation attempts against CVE-2017-5638 (Apache Struts) without modifying the server or taking it offline. The WAF inspects HTTP requests for malicious Content-Type headers used in the exploit and drops them, providing protection while the identical twin server remains unaffected and the vulnerable server can be patched later with minimal downtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Re-image the server with a hardened operating system
Why it's wrong here
Re-imaging a server, even with a hardened OS, is a highly disruptive and time-consuming process that involves significant downtime and reconfiguration. This action does not directly address the specific Apache Struts application-layer vulnerability, as the issue resides within the application code itself, not necessarily the underlying operating system hardening. Furthermore, it would require reinstalling and reconfiguring all applications, potentially introducing new misconfigurations or issues, making it an inefficient and disproportionate immediate response.
- ✓
Implement a virtual patch via web application firewall (WAF) rules
Why this is correct
Implementing a virtual patch through WAF rules provides an immediate and non-intrusive layer of protection by inspecting and filtering malicious traffic targeting the Apache Struts vulnerability. This method blocks known exploit patterns at the network edge, preventing successful attacks from reaching the vulnerable application without requiring changes to the server or application code. It effectively buys critical time for security teams to thoroughly test and deploy the official vendor patch in a controlled manner, minimizing service disruption.
- ✗
Shut down the vulnerable server until a patch can be tested
Why it's wrong here
Shutting down a vulnerable server immediately eliminates the risk of exploitation but comes at the severe cost of complete service unavailability. For critical business systems, this level of disruption is often unacceptable and can lead to significant financial losses and reputational damage. While it ensures security, it fails to maintain business continuity, making it an impractical primary solution when less disruptive mitigation strategies, like virtual patching, are available.
- ✗
Apply the vendor patch immediately during business hours
Why it's wrong here
Applying a vendor patch immediately during business hours without prior testing in a staging or non-production environment carries substantial risks. Untested patches can introduce unforeseen compatibility issues, performance degradation, or even new vulnerabilities, leading to system instability and unexpected downtime during peak operational periods. Proper change management dictates that patches should be thoroughly validated before deployment to production, especially for critical systems.
Go deeper
Related to this question
Learn chapter
Vulnerability Scanning Techniques
Key term
Exploitation
Exploitation is the act of using a vulnerability or weakness in a system, network, or application to gain unauthorized access, cause damage, or extract data.
Key term
CVE
CVE stands for Common Vulnerabilities and Exposures, which is a publicly available list of standardized identifiers for known security vulnerabilities in software and hardware.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.