Compensating Controls for Legacy Application Vulnerabilities
A legacy application cannot be patched for two weeks, but the security team still wants to reduce risk in the meantime. What is the best temporary measure?
Quick Answer
The answer is to add a compensating control such as restricting access to the system. This is correct because when a legacy application cannot be patched immediately, a compensating control—like a firewall rule limiting network access or disabling unnecessary services—reduces the attack surface by blocking exploit vectors until the patch is applied. On the Security+ SY0-701 exam, this scenario tests your understanding of defense-in-depth and risk mitigation strategies for unpatched legacy systems, where the common trap is to choose “apply a virtual patch” or “disable the application entirely,” both of which are either not temporary or too disruptive. Remember the memory tip: “Compensate, don’t eliminate”—you’re buying time, not solving the root cause.
⚠ Common exam trap
Watch out — candidates often choose 'Do nothing' assuming patching is the only valid action, but CompTIA expects you to recognize that compensating controls are a standard risk management strategy when immediate patching is not feasible.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a compensating control such as restricting access to the system.
Implementing a compensating control, such as restricting network access via firewall rules or disabling unnecessary services, reduces the attack surface while the legacy application remains unpatched. This aligns with the principle of defense-in-depth, where temporary mitigations like access control lists (ACLs) or host-based firewalls can block exploit vectors until the patch is applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Do nothing until the patch window opens.
Why it's wrong here
Leaving the issue unaddressed increases exposure during the delay.
- ✓
Add a compensating control such as restricting access to the system.
Why this is correct
A compensating control lowers risk while the permanent fix is unavailable.
- ✗
Disable all logging so the system runs faster.
Why it's wrong here
Removing logging makes detection and troubleshooting worse, not better.
- ✗
Rename the application so attackers cannot find it.
Why it's wrong here
Security by obscurity does not meaningfully reduce vulnerability risk.
Visual reference
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A legacy application server has a critical vulnerability, but the vendor will not release a fix for 30 days. Which two compensating controls are the best short-term risk reduction steps? Select two.
medium- ✓ A.Restrict access to the server to known admin IPs or a jump host.
- ✓ B.Place a web application firewall or IPS rule in front of the exposed service.
- C.Document the issue and wait for the vendor patch without making any changes.
- D.Open the service to more networks so monitoring tools can see it better.
- E.Disable logging to reduce the performance overhead caused by the vulnerability.
Why A: Restricting access to the server to known admin IPs or a jump host reduces the attack surface by limiting who can reach the vulnerable service. This network-layer control (e.g., using ACLs or firewall rules) prevents exploitation from untrusted sources while the vendor patch is pending. It is a classic compensating control that buys time without modifying the application itself.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.