easyMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A mid-sized e-commerce company uses a multi-cloud…
A mid-sized e-commerce company uses a multi-cloud environment with AWS and Azure. The vulnerability management team performs monthly authenticated scans using a commercial scanner. During the last scan, a critical remote code execution vulnerability (CVE-2023-XXXX) was identified on an EC2 instance running a legacy application. The application owner states that the instance cannot be patched immediately because the patch would break compatibility with a third-party API. The instance has direct internet access and handles PCI data. The CISO wants to reduce risk to an acceptable level within 48 hours. Which course of action should the analyst recommend?
⚠ Common exam trap
CompTIA often tests the concept that compensating controls (like WAF + security group restrictions) are acceptable for immediate risk reduction when patching is not feasible, and candidates mistakenly choose a delayed patch (Option C) or an irrelevant security fix (Option D) instead of the correct network-layer mitigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the EC2 instance behind a web application firewall (WAF) and restrict inbound access to known IPs using security groups.
Placing the EC2 instance behind a WAF and restricting inbound access to known IPs via security groups provides immediate, compensating controls that reduce the attack surface for the critical RCE vulnerability. Since the instance cannot be patched within 48 hours, this network-layer isolation (WAF filtering malicious payloads, security groups limiting source IPs) aligns with the CISO's risk reduction requirement while maintaining business operations and PCI compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Place the EC2 instance behind a web application firewall (WAF) and restrict inbound access to known IPs using security groups.
Why this is correct
This is a strong immediate mitigation strategy. A Web Application Firewall (WAF) inspects HTTP/S traffic and can block common attack patterns, including those leading to Remote Code Execution (RCE), without requiring application changes. Security groups act as a virtual firewall, limiting network access to only necessary IP addresses, significantly reducing the attack surface and potential for exploitation while a permanent fix is developed. This provides immediate protection for PCI data.
- ✗
Decommission the instance and remove the legacy application from service immediately.
Why it's wrong here
While removing a vulnerable system eliminates the risk, immediately decommissioning an instance hosting a legacy application that processes PCI data without a pre-planned migration or replacement strategy would severely disrupt critical business operations. This action would halt payment processing, leading to significant financial losses and customer dissatisfaction, making it an impractical and irresponsible first response to a critical vulnerability.
- ✗
Apply the vendor-recommended patch after testing in a dev environment within two weeks.
Why it's wrong here
Applying a vendor-recommended patch is the correct long-term solution, and testing in a development environment is crucial to prevent production issues. However, a two-week timeline for a critical Remote Code Execution (RCE) vulnerability exposing PCI data is unacceptably slow. Immediate action, such as implementing compensating controls like a WAF, is required to protect sensitive data and maintain compliance while the patch is being prepared for deployment.
- ✗
Disable TLS 1.0 and enable TLS 1.2 on the instance to reduce the attack surface.
Why it's wrong here
Disabling outdated TLS 1.0 and enabling TLS 1.2 is a best practice for improving cryptographic security and reducing the attack surface related to insecure communication protocols. However, this action specifically addresses vulnerabilities in the transport layer encryption, not the Remote Code Execution (RCE) vulnerability within the application itself. While important for overall security, it does not mitigate the immediate threat of arbitrary code execution on the server.
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.