mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A security analyst discovers a server that is…
A security analyst discovers a server that is missing multiple critical patches. The server hosts a legacy application that cannot be patched immediately due to compatibility issues. Which of the following is the BEST approach to manage the vulnerability risk?
⚠ Common exam trap
Test-takers frequently choose 'Apply a virtual patch using a WAF' because they overestimate the scope of WAF protection, forgetting that it only covers web-based attacks and not OS-level or protocol-level vulnerabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement network segmentation and increase monitoring
The best approach because network segmentation isolates the vulnerable legacy server from critical assets, reducing the attack surface, while increased monitoring allows the security team to detect and respond to any exploitation attempts in real time. This balances risk acceptance with active defense, which is a core principle of vulnerability management when patching is not immediately feasible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a virtual patch using a WAF
Why it's wrong here
Applying a virtual patch via a Web Application Firewall (WAF) primarily addresses vulnerabilities at the application layer for web-facing services, such as SQL injection or cross-site scripting. While a WAF can provide an additional layer of defense against certain attack vectors, it does not patch underlying operating system or non-web application vulnerabilities that might be present due to missing system updates. Furthermore, relying solely on a WAF can introduce latency and may not cover all potential exploitation paths for a broadly unpatched server.
- ✓
Implement network segmentation and increase monitoring
Why this is correct
Implementing network segmentation involves isolating the vulnerable server into a dedicated network segment, such as a specific VLAN or DMZ, to restrict its communication paths and limit potential lateral movement by an attacker. Concurrently, increasing monitoring through enhanced logging, intrusion detection/prevention systems (IDS/IPS), and security information and event management (SIEM) correlation allows for early detection of exploitation attempts or anomalous behavior. This combined approach significantly reduces the attack surface and improves incident response capabilities without disrupting critical business operations.
- ✗
Disable the server until a patch is available
Why it's wrong here
Disabling the server until a patch becomes available is an extreme measure that directly impacts business continuity and service availability. While it completely eliminates the immediate security risk by taking the vulnerable asset offline, it also halts all operations dependent on that server, potentially leading to significant operational disruption, productivity loss, and financial implications. This approach is generally considered a last resort when the vulnerability is critical, actively exploited, and no other viable mitigation strategies can be implemented to maintain service.
- ✗
Remove the server from the network
Why it's wrong here
Removing the server from the network completely severs its connectivity, rendering it inaccessible to users and other systems. This action effectively takes the server out of service, causing a complete cessation of the business function it provides. Such a drastic measure is highly disruptive and typically unacceptable for a server that fulfills an ongoing business need, as it prioritizes security over availability to an extent that is usually disproportionate when less impactful compensating controls, like segmentation and monitoring, are available.
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Attack surface
The attack surface is the total sum of all points in a system, network, or application where an unauthorized user can try to enter or extract data.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.