hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A small e-commerce company hosts its web…
A small e-commerce company hosts its web application on a single server with a public IP address. The server runs a Linux OS with Apache, MySQL, and PHP. The company recently experienced a data breach where an attacker gained access to the customer database. The investigation reveals that the attacker exploited a vulnerability in the PHP application to execute arbitrary commands. The server logs show that the attacker used an unauthenticated HTTP POST request to a legacy script that should have been removed. Additionally, the server had default firewall rules allowing all inbound traffic on ports 80 and 443. The company wants to prevent future breaches without redesigning the entire application. Which course of action is the most effective?
⚠ Common exam trap
ISC2 often tests the misconception that removing the vulnerable component (Option C) is sufficient, but the trap is that the question asks for preventing future breaches without redesigning the entire application, meaning a WAF provides ongoing protection against similar exploits in other parts of the application, whereas simply removing one script leaves other potential vulnerabilities unaddressed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a web application firewall (WAF) with virtual patching for the vulnerability.
The most effective because it provides immediate protection against the exploited vulnerability without requiring application redesign. A WAF with virtual patching can inspect HTTP POST requests to the legacy script and block malicious payloads, even if the underlying code remains vulnerable. This approach addresses the root cause (the unauthenticated exploit) while allowing the company to maintain operations and plan a permanent fix.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Move the database to a separate internal server and require VPN access for administration.
Why it's wrong here
This addresses database exposure but does not prevent the initial command injection attack on the web server.
- ✗
Upgrade the PHP version to the latest release and enable SELinux.
Why it's wrong here
Upgrading PHP may not fix the specific vulnerability if it is application-level, and SELinux would not prevent command injection in the web context.
- ✗
Remove the legacy script and update the firewall to block all traffic except necessary IPs.
Why it's wrong here
While removing the script helps, blocking all traffic except necessary IPs is impractical for a public web server and does not prevent future application-level attacks.
- ✓
Implement a web application firewall (WAF) with virtual patching for the vulnerability.
Why this is correct
A WAF can block the exploit and similar attacks without requiring code changes, providing immediate protection.
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
WAF
A Web Application Firewall (WAF) is a security tool that filters, monitors, and blocks HTTP traffic to and from a web application to protect it from common attacks.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.