CS0-003 Vulnerability Management Practice Question
A security analyst is reviewing the output of a vulnerability scan and sees a finding for a web application that uses a known vulnerable version of Apache Struts. Which TWO of the following actions should the analyst prioritize?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update Apache Struts to the latest patched version
Updating the component to a patched version is the primary remediation. If a patch is not immediately available, a WAF rule can provide temporary protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the Apache Struts component entirely
Why it's wrong here
Removing the Apache Struts component outright would effectively disable any application functionality that depends on this framework, causing a denial of service for legitimate users. The vulnerability is not eliminated by deletion; the component is a core dependency, and the vendor's patch specifically addresses the security flaw while preserving functionality. Uninstalling a critical library is a disruptive and incomplete remedy that introduces configuration and compatibility risks.
- ✗
Reboot the web server to clear memory
Why it's wrong here
Rebooting the web server only clears the current in-memory process state, which may temporarily halt an already-running exploit, but it does not change or patch the vulnerable Apache Struts library on disk. The vulnerability remains fully present in the application code, so the same attack will succeed immediately after the system comes back online. Reboots are not a security control; they do not remediate the underlying code flaw.
- ✓
Update Apache Struts to the latest patched version
Why this is correct
Upgrading Apache Struts to the latest patched version is the primary remediation because it replaces the vulnerable code with a release that includes the security fix for the specific CVE. This action directly addresses the root cause of the flaw and eliminates the attack vector for known exploit patterns. Vendor patches are thoroughly tested and are the most reliable way to restore a secure state.
- ✗
Disable the web application until further notice
Why it's wrong here
Taking the web application offline halts all business operations and denies access to legitimate clients, which is an excessively disruptive measure when a patch is available or a WAF rule can serve as a temporary control. Disabling the application does not remove the vulnerable component from the environment; the risk persists until the underlying Struts library is patched. Organizational impact should be weighed against the availability of less invasive, equally effective safeguards.
- ✓
Implement a WAF rule to block known exploit patterns
Why this is correct
Implementing a Web Application Firewall rule that matches known exploit signatures for the Apache Struts vulnerability provides a virtual patch, blocking malicious requests without changing the application code. This is a valid compensating control because it reduces the immediate likelihood of exploitation while the organization schedules the official update. However, a WAF rule is not a permanent fix; attackers can craft payloads that evade signature-based detection, so the patched Struts build must still be deployed as the definitive remediation.
Go deeper
Related to this question
Learn chapter
Vulnerability Scanning Techniques
Key term
Vulnerability scan
A vulnerability scan is an automated process that checks systems, networks, and applications for known security weaknesses or misconfigurations.
Key term
Remediation
Remediation is the process of fixing or eliminating vulnerabilities, misconfigurations, or security weaknesses in an IT environment.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.