Question 949 of 1,013
Compensating Controls for Legacy Application Vulnerabilities
A legacy application cannot be patched for two weeks, but the security team still wants to reduce risk in the meantime. What is the best temporary measure?
Quick Answer
The answer is to add a compensating control such as restricting access to the system. This is correct because when a legacy application cannot be patched immediately, a compensating control—like a firewall rule limiting network access or disabling unnecessary services—reduces the attack surface by blocking exploit vectors until the patch is applied. On the Security+ SY0-701 exam, this scenario tests your understanding of defense-in-depth and risk mitigation strategies for unpatched legacy systems, where the common trap is to choose “apply a virtual patch” or “disable the application entirely,” both of which are either not temporary or too disruptive. Remember the memory tip: “Compensate, don’t eliminate”—you’re buying time, not solving the root cause.
⚠ Common exam trap
Watch out — candidates often choose 'Do nothing' assuming patching is the only valid action, but CompTIA expects you to recognize that compensating controls are a standard risk management strategy when immediate patching is not feasible.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a compensating control such as restricting access to the system.
Implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Do nothing until the patch window opens.
Why it's wrong here
Leaving the issue unaddressed increases exposure during the delay.
- ✓
Add a compensating control such as restricting access to the system.
Why this is correct
A compensating control lowers risk while the permanent fix is unavailable.
- ✗
Disable all logging so the system runs faster.
Why it's wrong here
Removing logging makes detection and troubleshooting worse, not better.
- ✗
Rename the application so attackers cannot find it.
Why it's wrong here
Security by obscurity does not meaningfully reduce vulnerability risk.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A legacy application server has a critical vulnerability, but the vendor will not release a fix for 30 days. Which two compensating controls are the best short-term risk reduction steps? Select two.
medium- ✓ A.Restrict access to the server to known admin IPs or a jump host.
- ✓ B.Place a web application firewall or IPS rule in front of the exposed service.
- C.Document the issue and wait for the vendor patch without making any changes.
- D.Open the service to more networks so monitoring tools can see it better.
- E.Disable logging to reduce the performance overhead caused by the vulnerability.
Why A: Restricting access to the server to known admin IPs or a jump host reduces the attack surface by limiting who can reach the vulnerable service. This network-layer control (e.g., using ACLs or firewall rules) prevents exploitation from untrusted sources while the vendor patch is pending. It is a classic compensating control that buys time without modifying the application itself.
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.