SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Ignore the finding until the next quarterly review because there is no patch available.

  Why it's wrong here

  Deferring remediation until the next quarterly review after a critical vulnerability is detected is a high-risk decision because exploit code will often be publicly available within days or hours of disclosure. Even with no vendor-provided patch, you can and should implement temporary controls such as network-based blocking or workarounds to reduce the attack surface. Allowing the system to remain fully exposed for another quarter gives attackers a large window of opportunity, and the business impact of a successful exploit is likely to far outweigh the effort of applying a compensating control.

• ✗

  Move the appliance to a less critical VLAN and leave all access rules unchanged.

  Why it's wrong here

  Simply relocating the appliance to a less critical VLAN without modifying the firewall or access control rules does not reduce its attack surface, because the vulnerable service remains reachable from the same networks as before. For VLAN segmentation to be effective, you must create new access control lists or firewall rules that restrict inbound and outbound traffic to and from that VLAN. Leaving existing rules unchanged means the system is still exposed to the same hostile traffic, and it may now also break monitoring or management workflows that rely on the original network path.

• ✓

  Apply virtual patching or traffic filtering to block exploit attempts until remediation is possible.

  Why this is correct

  Applying virtual patching or traffic filtering is the correct immediate response because it blocks or mitigates exploit attempts against the vulnerability while a permanent vendor patch is developed, tested, and deployed. A virtual patch is often implemented as an intrusion prevention system (IPS) rule, web application firewall (WAF) signature, or a firewall rule that specifically detects and drops malicious traffic matching the exploit pattern. This compensating control reduces the real-world risk to the system and can be deployed quickly, but it must be tested to avoid false positives and should be removed once the actual patch is installed.

• ✗

  Disable logging so that attackers cannot learn the appliance version from log data.

  Why it's wrong here

  Disabling logging on a vulnerable appliance is counterproductive because it removes the only source of evidence that could alert you to an ongoing attack or later help you investigate a breach. Attackers do not rely on your logs to identify the appliance version; they typically use banner grabbing, malformed probes, or known service behavior to fingerprint the system. Moreover, losing log data violates many compliance requirements and severely hampers incident response forensics, all while leaving the vulnerability itself completely unaddressed, so this action increases risk rather than reducing it.

Go deeper

Related to this question