SY0-701 Security Operations Practice Question
A legacy application server has a critical vulnerability, but the vendor will not release a fix for 30 days. Which two compensating controls are the best short-term risk reduction steps? Select two.
⚠ Common exam trap
It's easy for candidates to think documenting the issue (Option C) is sufficient or that increasing monitoring (Option D) is a control, but CompTIA expects active risk reduction measures like access restriction and virtual patching, not passive or counterproductive actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict access to the server to known admin IPs or a jump host.
Restricting access to the server to known admin IPs or a jump host reduces the attack surface by limiting who can reach the vulnerable service. This network-layer control (e.g., using ACLs or firewall rules) prevents exploitation from untrusted sources while the vendor patch is pending. It is a classic compensating control that buys time without modifying the application itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restrict access to the server to known admin IPs or a jump host.
Why this is correct
Restricting access to the server via network ACLs, security groups, or firewall rules to only known administrative IPs or a hardened jump host directly shrinks the attack surface. This effectively filters out the vast majority of potential exploit attempts from untrusted networks while the vulnerability remains unpatched. A jump host also centralizes access, enabling stronger authentication, session logging, and audit trails, which further reduces the likelihood and impact of an attacker reaching the vulnerable application.
- ✓
Place a web application firewall or IPS rule in front of the exposed service.
Why this is correct
Deploying a web application firewall or intrusion prevention system (IPS) in front of the exposed service provides a virtual patch, intercepting and blocking malicious traffic that targets the known CVE. These devices can inspect payloads for exploit signatures, reject malformed requests, and enforce rate limits, thereby mitigating the live risk without taking the server offline. This is a classic compensating control that aligns with defense-in-depth during the patch window.
- ✗
Document the issue and wait for the vendor patch without making any changes.
Why it's wrong here
Documenting the vulnerability and simply waiting for the vendor patch does not alter the server’s exposure or exploitability, leaving the known flaw accessible to any reachable attacker. In the 30-day window, attackers can scan for and weaponize the CVE, and documentation alone provides no defensive impact. The organization fails to implement any temporary control, so the risk remains at its original elevated level until a patch is applied.
- ✗
Open the service to more networks so monitoring tools can see it better.
Why it's wrong here
Expanding network reachability so monitoring tools can observe the service is counterproductive; it increases the number of hosts that can reach the vulnerable service and thereby expands the potential attack surface. Monitoring should be implemented through out-of-band methods, such as passive taps, NetFlow, or logging aggregation, never by broadening access. This action violates the principle of least privilege and actively increases the chance of exploitation.
- ✗
Disable logging to reduce the performance overhead caused by the vulnerability.
Why it's wrong here
Disabling logging is unrelated to the underlying vulnerability and undermines security operations; the vulnerability remains present and exploitable regardless of log generation. More importantly, logs are essential for detecting an attempted or successful exploitation, and turning them off leaves the blue team blind and eliminates forensic evidence. Performance overhead is not a valid reason to sacrifice visibility, especially when a critical flaw is already known.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Exploitation
Exploitation is the act of using a vulnerability or weakness in a system, network, or application to gain unauthorized access, cause damage, or extract data.
Key term
Attack surface
The attack surface is the total sum of all points in a system, network, or application where an unauthorized user can try to enter or extract data.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A legacy application cannot be patched for two weeks, but the security team still wants to reduce risk in the meantime. What is the best temporary measure?
easy- A.Do nothing until the patch window opens.
- ✓ B.Add a compensating control such as restricting access to the system.
- C.Disable all logging so the system runs faster.
- D.Rename the application so attackers cannot find it.
Why B: Implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.