Question 1,019 of 1,013
Applying Compensating Controls While Awaiting a Patch
A monthly scan finds a critical remote-code-execution issue on an internet-facing VPN appliance. The vendor has released a fix, but the appliance can only be rebooted during the weekend maintenance window in five days. What is the BEST immediate action to lower risk until patching can occur?
Quick Answer
The correct answer is to apply a compensating control such as restricting access to trusted source IPs and disabling nonessential remote access features. This is the best immediate action because it reduces the attack surface without requiring a reboot, directly addressing the critical remote-code-execution vulnerability on the internet-facing VPN appliance while awaiting the vendor patch. In the Security+ SY0-701 exam, this scenario tests your understanding of risk mitigation strategies when patching is delayed—specifically, that compensating controls like ACLs or disabling unused protocols are temporary, network-layer defenses that buy time until the scheduled maintenance window. A common trap is choosing to simply reboot or unplug the device, but the question asks for the *best immediate action to lower risk*, not eliminate it entirely. Remember the mnemonic “ACL before Reboot” to recall that access controls come first when compensating controls before patch are needed.
⚠ Common exam trap
Candidates often think waiting for the maintenance window is acceptable because the vulnerability is unconfirmed, but the exam expects proactive risk reduction through compensating controls rather than passive delay.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a compensating control such as restricting access to trusted source IPs and disabling nonessential remote access features
Applying a compensating control—such as restricting access to trusted source IPs via an ACL and disabling nonessential remote access features like unused VPN protocols or administrative interfaces—immediately reduces the attack surface. This mitigates the risk of exploitation of the remote-code-execution vulnerability on the internet-facing VPN appliance until the vendor patch can be applied during the scheduled maintenance window. The key is to implement network-layer controls that block untrusted sources from reaching the vulnerable service, buying time without requiring a reboot.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply a compensating control such as restricting access to trusted source IPs and disabling nonessential remote access features
Why this is correct
A compensating control lowers exposure right away when the patch cannot be installed immediately, which is the safest short-term option.
- ✗
Wait for the weekend because the exploit is not confirmed
Why it's wrong here
Waiting leaves a critical internet-facing vulnerability exposed and ignores the fact that risk exists even without confirmed exploitation.
- ✗
Remove logging from the appliance to improve performance during the wait
Why it's wrong here
Removing logs reduces visibility and makes investigation harder without reducing the actual vulnerability.
- ✗
Run another scan every hour and do nothing else
Why it's wrong here
Repeated scanning increases noise but does not reduce exposure or protect the vulnerable service.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A monthly scan finds a critical remote-code-execution vulnerability on an internet-facing VPN appliance. The vendor has not released a patch for six weeks, but the service must stay online. Which short-term action is the best risk treatment?
medium- A.Accept the risk and wait for the next scheduled scan cycle.
- ✓ B.Apply compensating controls such as strict access filtering, MFA, enhanced logging, and alerting.
- C.Disable all logging so the appliance performs better under load.
- D.Ignore the issue until the vendor confirms the vulnerability is being actively exploited.
Why B: When a patch is unavailable for a critical vulnerability, compensating controls reduce risk without taking the service offline. For an internet-facing VPN appliance, strict access filtering (e.g., limiting source IPs via ACLs), enforcing MFA, and enabling enhanced logging/alerting can mitigate exploitation attempts while maintaining availability. This aligns with the risk treatment strategy of risk reduction through controls rather than acceptance, avoidance, or transfer.
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.