SY0-701 Security Operations Practice Question
A security scan finds a critical patch missing on a public-facing web server. The patch has already been tested in the lab and approved for deployment. What should the operations team do next?
⚠ Common exam trap
Many candidates assume a firewall or risk acceptance can substitute for patching a known vulnerability, but the exam emphasizes that compensating controls (like firewalls) do not eliminate the need for patch management, and risk acceptance requires formal business notification and approval.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the patch through the normal change process as soon as possible
The patch has already been tested and approved, meaning it is ready for deployment. The operations team should follow the normal change management process to deploy the patch as soon as possible, ensuring the public-facing web server is secured against the critical vulnerability without bypassing organizational controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the finding because the server is already protected by a firewall
Why it's wrong here
Even a properly configured firewall only filters network traffic and does not remediate the underlying code flaw in a public-facing service. An attacker can often reach the service through allowed ports (e.g., 80/443), so the vulnerability remains exploitable for the exact protocol the server is meant to serve. Defense-in-depth principles require patching in addition to network controls, not as a substitute.
- ✓
Deploy the patch through the normal change process as soon as possible
Why this is correct
This is correct because it balances urgency with stability: the patch should already have been tested and validated through the organization's change advisory board, so deploying it through the standard change process minimizes operational risk while eliminating the known vulnerability. Rapid deployment reduces the time-to-exploit, especially since public servers are continuously probed by automated scanners. Deferring the patch leaves a confirmed, vendor-flagged critical vulnerability exposed.
- ✗
Mark the vulnerability as accepted risk without notifying the business
Why it's wrong here
Risk acceptance is a formal decision that requires a documented exception, explicit authorization from the system owner, and a clear understanding of the business impact and likelihood of exploitation—none of which happen when someone silently marks it as accepted. This unilateral action violates change-management and risk-governance policy and blinds the business to the actual exposure. Even if the risk is genuinely acceptable, the business owner must make that call with full knowledge of residual risk.
- ✗
Remove the web server from the asset inventory to prevent the scanner from finding it
Why it's wrong here
Removing an asset from CMDB or inventory only hides the machine from visibility; it does not alter the code or configuration that makes it vulnerable, and the public-facing service is still exposed to the internet. This practice degrades security monitoring, patching workflows, and incident response because the server will no longer receive required updates or be covered by security tools. It is effectively the opposite of good governance—concealing rather than remediating the issue.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.