SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A vulnerability scan of a Linux application server reports these findings: OpenSSL 3.0.7 is flagged with a critical CVE, but the distribution vendor note says the fix was backported. Port 8443 is bound to all interfaces, yet a firewall blocks it from the internet. The internal admin console on that port still uses the default admin/admin credentials and is reachable from the corporate VLAN. Which issue should be remediated first?
⚠ Common exam trap
The trap here is that candidates focus on the critical CVE and the firewall rule, overlooking that default credentials on an internally reachable service pose a more immediate and easily exploitable risk than a patched vulnerability or a network control that does not protect against internal threats.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the default credentials on the internal admin console and restrict access to only approved management hosts.
The most immediate risk is that an attacker on the corporate VLAN can access the internal admin console using default credentials (admin/admin). This bypasses the firewall and allows full control of the application server. Even though OpenSSL has a backported fix, the default credentials represent an active, easily exploitable vulnerability that requires no additional exploit development.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upgrade OpenSSL immediately, because the reported CVE proves the package is exploitable as installed.
Why it's wrong here
The version of OpenSSL reported by the scanner may show an older version number, but the operating system vendor often backports security fixes to maintained releases, meaning the binary contains the patch while the version string remains unchanged. Without confirming via the vendor's advisory or testing the specific state, the CVE does not prove exploitable exposure. Even if it were real, the default 'admin/admin' credentials on a reachable interface are a direct, trivial compromise path that should be remediated first.
- ✗
Ignore the 8443 service, because the internet firewall already prevents external exposure.
Why it's wrong here
A firewall that blocks internet access does not protect against authenticated users on the local network, nor against attackers who have already compromised a machine on the corporate VLAN. The 8443 service's administrative console is still reachable from internal hosts, so an internal user could connect and try the default credentials, gaining immediate control of the application server. Ignoring it because of the boundary firewall misses a common lateral movement path and violates a defense-in-depth principle.
- ✓
Change the default credentials on the internal admin console and restrict access to only approved management hosts.
Why this is correct
Default credentials on a reachable administrative interface are the highest-risk issue in the list. The console is accessible from the corporate VLAN, so an internal attacker or compromised endpoint could log in immediately without needing a vulnerability exploit. The OpenSSL finding may be a false positive due to backporting, and the firewall already limits internet reach, but default admin/admin credentials create direct compromise risk.
- ✗
Leave the console as-is and focus only on changing the bind address to 127.0.0.1.
Why it's wrong here
Changing the bind address to loopback would reduce network exposure, but it does nothing about the fact that the console currently uses default credentials; any service that already has local access, or any configuration that proxies or tunnels the port, would still face the same trivial authentication bypass. Moreover, the first remediation step should address the highest-risk, easiest-to-exploit issue—default administrative credentials—not just harden the network plumbing. If an attacker has already accessed the system, they can use those credentials locally, and the loopback change wouldn't prevent that.
Visual reference
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team can patch only one system today. Which asset should be remediated first?
easy- A.An internal print server with a high-severity finding and no direct user access
- B.A lab workstation with a critical finding and no sensitive data
- ✓ C.An internet-facing application server with a critical vulnerability and a known exploit
- D.A user laptop with a medium-severity issue that requires local access
Why C: An internet-facing application server with a critical vulnerability and a known exploit represents the highest risk: it is exposed to external threats, the vulnerability is critical, and a known exploit means attackers can reliably compromise it. Patching this system first reduces the likelihood of a remote breach that could lead to data exfiltration or service disruption, aligning with the principle of prioritizing assets with the greatest attack surface and exploitability.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.