easyMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A security analyst is reviewing vulnerability…
A security analyst is reviewing vulnerability scan results and sees a critical vulnerability on a web server with a CVSS score of 9.8. The server is a legacy system that cannot be patched without causing application downtime. The business requires the application to remain available. Which of the following is the BEST course of action?
⚠ Common exam trap
CompTIA often tests the misconception that a critical vulnerability always requires immediate patching or removal, when in reality compensating controls like a WAF virtual patch are the preferred risk treatment for legacy systems that cannot be taken offline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a virtual patch using a web application firewall.
A virtual patch via a web application firewall (WAF) can inspect and block exploit attempts against the vulnerability without modifying the legacy server's code or binaries. This allows the business-critical application to remain available while mitigating the 9.8 CVSS risk at the network layer, typically using signature-based or behavioral rules to intercept malicious payloads targeting the flaw.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the system from the network.
Why it's wrong here
Removing a system from the network, while preventing immediate exploitation, renders it completely unavailable to users and dependent applications. This action directly violates the availability principle of the CIA triad and would severely disrupt business operations, making it an unacceptable solution unless the system is non-critical or being decommissioned. Such a drastic measure is typically reserved for severe, uncontainable threats where business continuity is already compromised.
- ✗
Disable the vulnerable service on the server.
Why it's wrong here
Disabling a vulnerable service directly on the server, while mitigating the specific vulnerability, often leads to partial or complete application downtime if that service is essential for its functionality. This approach can negatively impact user experience and business processes that rely on the application, making it a disruptive and often impractical short-term fix. A more nuanced approach is usually required to maintain service continuity.
- ✗
Accept the risk and do nothing.
Why it's wrong here
Accepting the risk and taking no action is generally an irresponsible risk management strategy, especially when known vulnerabilities exist and viable mitigation options are available. This approach leaves the organization exposed to potential exploitation, data breaches, and reputational damage, which could incur significant financial and operational costs. It should only be considered for extremely low-impact, low-probability risks after a thorough risk assessment, and even then, usually with a plan for periodic re-evaluation.
- ✓
Implement a virtual patch using a web application firewall.
Why this is correct
Implementing a virtual patch using a Web Application Firewall (WAF) is an effective and non-disruptive mitigation strategy. A WAF can inspect incoming traffic and block malicious requests targeting known vulnerabilities, effectively shielding the application without modifying its underlying code or taking it offline. This approach allows organizations to mitigate immediate risks and maintain system availability while awaiting a vendor-supplied patch or a more permanent code fix.
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Vulnerability scan
A vulnerability scan is an automated process that checks systems, networks, and applications for known security weaknesses or misconfigurations.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.