SY0-701 Security Operations Practice Question
Exhibit
Server: HR-APP02 Finding: Outdated OpenSSL library with a critical remotely exploitable weakness Vendor status: Fix unavailable for 21 days Exposure: The service must remain online Current access: host firewall allows TCP 443 from any source Monitoring: Monthly vulnerability scans only Available controls: reverse proxy, WAF, IP allow lists, jump host for administration
Based on the exhibit, which temporary control best reduces risk until the patch is released?
⚠ Common exam trap
CompTIA often tests the misconception that increasing monitoring (scan frequency) is a sufficient compensating control, when in fact it does not prevent exploitation—only detection is improved.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the service behind a reverse proxy or WAF and restrict access with source IP allow lists.
Placing the service behind a reverse proxy or Web Application Firewall (WAF) with source IP allow lists provides a temporary compensating control that reduces the attack surface until the vendor releases a patch. The reverse proxy or WAF can inspect and filter malicious traffic, while IP allow lists restrict access to trusted sources only, mitigating the risk of exploitation without removing the service entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase scan frequency to daily and leave the service exposed.
Why it's wrong here
Increasing scan frequency to daily only improves the organization's ability to detect that the service is still vulnerable; it does not prevent an attacker from directly reaching and exploiting the vulnerable library. In fact, each scan is a noisy probe that may alert defenders but does not stop the attack itself. Without a network-level or application-layer compensating control, the vulnerable endpoint remains accessible to anyone who finds it, so the residual risk stays exactly the same until a patch is applied.
- ✓
Place the service behind a reverse proxy or WAF and restrict access with source IP allow lists.
Why this is correct
The service must stay online, but the patch is unavailable, so the best temporary measure is to reduce exposure. A reverse proxy or WAF can filter malicious requests, and source IP allow lists shrink the reachable attack surface. Together, those controls act as an effective compensating measure until the vendor fix is released and can be applied.
- ✗
Disable TLS so the traffic can be inspected more easily.
Why it's wrong here
Disabling TLS would strip confidentiality and integrity from all traffic, allowing attackers to passively capture credentials or modify responses in transit. While plaintext traffic might be easier for inspectors to read, it does nothing to block malformed requests targeting the vulnerable library. The change would add serious data-exposure risks while leaving the original vulnerability fully exploitable, making the overall security posture worse.
- ✗
Move administrative access to the same 443 listener as user traffic.
Why it's wrong here
Moving administrative access to the same 443 listener as user traffic eliminates the separation of duties and network segmentation that typically protects admin functions. A compromise of the public-facing service would then give an attacker direct access to the administrative plane, and any exploit against the vulnerable library would be just as effective. This action increases the impact of a successful attack rather than reducing the likelihood, so it fails as a temporary control.
Visual reference
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Web Application Firewall
A Web Application Firewall (WAF) is a security tool that monitors, filters, and blocks HTTP traffic to and from a web application to protect it from common attacks.
Key term
Reverse proxy
A reverse proxy is a server that sits in front of one or more backend servers, intercepting client requests and forwarding them to the appropriate server, then returning the server's response to the client as if it came from the reverse proxy itself.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.