CS0-003 Security Operations Practice Question
A vulnerability scan report shows a critical vulnerability with a CVSS score of 9.8 on an internal web server. The server is not internet-facing and is protected by a compensating control: a web application firewall (WAF) that blocks the attack vector. What should the analyst recommend?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the compensating control and reduce the risk rating
The vulnerability has a high CVSS score, but the compensating control (WAF) reduces the risk. The analyst should document the control and adjust the risk rating rather than patching immediately if patching would cause downtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Schedule an immediate emergency patch
Why it's wrong here
While patching is the ultimate remediation, scheduling an immediate emergency patch is unnecessary and introduces operational risk, such as system instability or downtime. Because an active Web Application Firewall (WAF) serves as an effective compensating control, the immediate threat is mitigated, allowing the security team to thoroughly test and schedule the patch during a standard maintenance window.
- ✗
Remove the WAF to ensure the vulnerability is addressed
Why it's wrong here
Deactivating or removing the Web Application Firewall (WAF) would strip away an active layer of defense, immediately exposing the unpatched application to exploitation. This action unnecessarily increases the organization's attack surface and risk profile. Security best practices dictate maintaining compensating controls until a permanent fix can be safely deployed and verified.
- ✓
Document the compensating control and reduce the risk rating
Why this is correct
Proper risk management requires documenting the active compensating control, such as a WAF rule blocking the specific exploit vector, within the risk register. Because this control significantly reduces the likelihood of successful exploitation, the risk rating should be adjusted downward to reflect the actual residual risk. This ensures accurate reporting and prioritization for the security team.
- ✗
Ignore the finding because it is a false positive
Why it's wrong here
The vulnerability scanner's finding is technically accurate and represents a real flaw in the application, meaning it is not a false positive. Simply ignoring the report is a dangerous practice, as compensating controls like WAFs can be bypassed, misconfigured, or temporarily disabled. The vulnerability must still be tracked and eventually remediated, rather than dismissed entirely.
Go deeper
Related to this question
Learn chapter
SOC Tier 1, Tier 2, and Tier 3 Analyst Roles
Key term
CVSS
The Common Vulnerability Scoring System (CVSS) is a standardized framework used to rate the severity of security vulnerabilities on a scale from 0 to 10.
Key term
Vulnerability scan
A vulnerability scan is an automated process that checks systems, networks, and applications for known security weaknesses or misconfigurations.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.