SY0-701 Security Operations Practice Question
A vulnerability scan finds that an old print server still has SMBv1 enabled. The business says the vendor will not support a patch for at least two months, but the server must stay online. What is the best temporary mitigation?
⚠ Common exam trap
It's easy for candidates to choose a reactive measure like rebooting or a non-technical control like password changes, failing to recognize that containment via network segmentation is the only proactive defense that directly limits the exploit's reach without requiring a patch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move the server to a restricted network segment and allow SMB access only from required hosts.
Network segmentation is the most effective temporary mitigation when a patch is unavailable. By moving the print server to a restricted VLAN or firewall zone and applying an access control list (ACL) that permits SMB traffic only from known, required hosts, you reduce the attack surface and prevent widespread exploitation of SMBv1 vulnerabilities (e.g., EternalBlue). This approach follows the principle of least privilege and containment, buying time until the vendor releases a patch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Move the server to a restricted network segment and allow SMB access only from required hosts.
Why this is correct
Isolating the server on a restricted network segment is a sound compensating control; it shrinks the attack surface to only those hosts that legitimately require SMB access, reducing the number of potential exploit sources while the vendor patch is pending. Because SMBv1 is remotely exploitable without authentication in many cases, limiting connectivity via firewall rules is more effective than relying on host-level hardening. This approach aligns with network segmentation principles and does not hide or destroy security-relevant data.
- ✗
Turn off endpoint logging to reduce performance impact until the vendor releases a patch.
Why it's wrong here
Disabling endpoint logging removes the ability to detect reconnaissance or exploitation attempts, directly undermining incident response and forensics. The performance impact of logging is typically minimal and does not justify creating a monitoring blind spot, especially for a high-risk legacy service. Furthermore, this change does nothing to block or mitigate the SMBv1 vulnerability, so the server remains just as exposed as before.
- ✗
Increase the password length requirement for all users and keep the server on the same network.
Why it's wrong here
Requiring longer passwords only strengthens authentication and does nothing to mitigate a remotely exploitable network service like SMBv1, which often can be compromised without any valid credentials. Keeping the server on the same network segment means every host on that segment can still reach the vulnerable SMB port, leaving the attack surface essentially unchanged. Password policy is a useful baseline control but is irrelevant to unauthenticated protocol vulnerabilities.
- ✗
Schedule a weekly reboot to clear any malicious sessions and reduce the chance of exploitation.
Why it's wrong here
A weekly reboot clears current sessions but does not patch the underlying SMBv1 flaw, so any new exploitation attempt will succeed again after the server comes back up. Rebooting also introduces availability disruptions and may destroy volatile evidence of an attacker's activity. This action is effectively a temporary session reset, not a security control, and does not reduce the likelihood of future compromise.
Visual reference
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.