The answer is to add a compensating control such as restricting access to the system. This is correct because when a legacy application cannot be patched immediately, a compensating control—like a firewall rule limiting network access or disabling unnecessary services—reduces the attack surface by blocking exploit vectors until the patch is applied. On the Security+ SY0-701 exam, this scenario tests your understanding of defense-in-depth and risk mitigation strategies for unpatched legacy systems, where the common trap is to choose “apply a virtual patch” or “disable the application entirely,” both of which are either not temporary or too disruptive. Remember the memory tip: “Compensate, don’t eliminate”—you’re buying time, not solving the root cause.
SY0-701 Security Operations Practice Question
This SY0-701 practice question tests your understanding of security operations. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A legacy application cannot be patched for two weeks, but the security team still wants to reduce risk in the meantime. What is the best temporary measure?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a compensating control such as restricting access to the system.
Option B is correct because implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Do nothing until the patch window opens.
Why it's wrong here
Leaving the issue unaddressed increases exposure during the delay.
✓
Add a compensating control such as restricting access to the system.
Why this is correct
A compensating control lowers risk while the permanent fix is unavailable.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Disable all logging so the system runs faster.
Why it's wrong here
Removing logging makes detection and troubleshooting worse, not better.
✗
Rename the application so attackers cannot find it.
Why it's wrong here
Security by obscurity does not meaningfully reduce vulnerability risk.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may choose 'Do nothing' assuming patching is the only valid action, but CompTIA expects you to recognize that compensating controls are a standard risk management strategy when immediate patching is not feasible.
Detailed technical explanation
How to think about this question
Compensating controls for unpatched systems often involve network segmentation using VLANs or micro-segmentation, or deploying a web application firewall (WAF) to filter malicious traffic. In real-world scenarios, organizations might also use host-based intrusion prevention systems (HIPS) or application whitelisting to block unauthorized code execution. The key is to isolate the system from untrusted networks while maintaining necessary functionality.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
Security Operations — This question tests Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Add a compensating control such as restricting access to the system. — Option B is correct because implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A legacy application server has a critical vulnerability, but the vendor will not release a fix for 30 days. Which two compensating controls are the best short-term risk reduction steps? Select two.
medium
✓ A.Restrict access to the server to known admin IPs or a jump host.
✓ B.Place a web application firewall or IPS rule in front of the exposed service.
C.Document the issue and wait for the vendor patch without making any changes.
D.Open the service to more networks so monitoring tools can see it better.
E.Disable logging to reduce the performance overhead caused by the vulnerability.
Why A: Option A is correct because restricting access to the server to known admin IPs or a jump host reduces the attack surface by limiting who can reach the vulnerable service. This network-layer control (e.g., using ACLs or firewall rules) prevents exploitation from untrusted sources while the vendor patch is pending. It is a classic compensating control that buys time without modifying the application itself.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.