SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A public-facing file transfer server is running an appliance firmware version that is now end-of-life. The vendor has stated that no further security patches will be released. Management wants the best long-term fix before the next audit. What should be done?
⚠ Common exam trap
CompTIA often tests the misconception that compensating controls like logging, segmentation, or password changes are sufficient to mitigate end-of-life vulnerabilities, when the only proper long-term fix is to upgrade or replace the unsupported software.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Replace or upgrade the end-of-life firmware with a supported version.
Running end-of-life firmware means no security patches will be released, leaving the server vulnerable to known exploits. The best long-term fix is to replace or upgrade to a supported firmware version that receives ongoing security updates, ensuring the system remains secure for the next audit and beyond.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase logging and keep the current firmware until a problem appears.
Why it's wrong here
Increasing logging and retaining end-of-life firmware only enhances detection, not prevention. The appliance remains exposed to known, unpatched vulnerabilities that attackers can exploit to gain access before any log alert is triggered. Logs might indicate a compromise has occurred, but they cannot remediate the unsupported firmware or restore vendor patch availability, so the risk persists indefinitely.
- ✗
Move the server to a different subnet and continue using the same firmware.
Why it's wrong here
Moving the server to a different subnet is a network segmentation control that reduces the blast radius of a compromise, but it does not address the fact that the public-facing appliance itself remains vulnerable. Since the server must still be reachable by external users, attackers can directly target the unsupported firmware's known flaws over the network. Segmentation is a compensating control at best; it neither patches the firmware nor protects the device from exploits that work across routed boundaries.
- ✓
Replace or upgrade the end-of-life firmware with a supported version.
Why this is correct
Replacing or upgrading the unsupported firmware is the best long-term fix because it restores the ability to receive patches and vendor support. That directly addresses the outdated component risk instead of merely masking it with monitoring or network controls.
- ✗
Change the administrator password and leave the device in place.
Why it's wrong here
Changing the administrator password only strengthens authentication for the management interface and does nothing to alter the vulnerable application code running on end-of-life firmware. Many flaws in file transfer appliances are remotely exploitable without valid credentials, such as buffer overflows or command injection in the network service. Credential management is a security hygiene best practice, but it cannot mitigate the unpatched software defects that are the actual root cause of the risk.
Go deeper
Related to this question
Learn chapter
ICS and SCADA Security Threats
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.