mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A software company uses a third-party library…
A software company uses a third-party library that has a known critical vulnerability. The library is used extensively and rewriting the code would take months. What is the BEST immediate action to reduce risk?
⚠ Common exam trap
Watch out — candidates often choose 'Remove the library immediately' (Option A) because it seems like the most direct fix, but they fail to consider the business continuity impact and the need for a risk-based, phased approach to remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a Web Application Firewall (WAF) rule to block exploitation
Implementing a Web Application Firewall (WAF) rule to block exploitation provides an immediate, compensating control that mitigates the known vulnerability without requiring code changes. This is the best immediate action because it buys time for a permanent fix while reducing risk, aligning with the principle of defense in depth. The WAF can inspect HTTP/HTTPS traffic for attack patterns (e.g., SQL injection, path traversal) specific to the vulnerable library and block malicious requests at the application layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the library from the codebase immediately
Why it's wrong here
Removing a critical third-party library immediately from a production codebase is highly impractical and would almost certainly introduce severe application instability or complete functional failure. Such a drastic change requires extensive development, testing, and deployment cycles to replace or re-engineer the affected functionalities. Therefore, it is not a viable immediate mitigation strategy for a known vulnerability.
- ✗
Disable the vulnerable feature in the library
Why it's wrong here
Disabling a specific vulnerable feature within a third-party library is often not a readily available configuration option, especially if the library is provided as a compiled binary without source code access. Even if possible, disabling a core feature could significantly impair the application's intended functionality, potentially rendering it unusable. This approach lacks the flexibility and immediate impact needed for a rapid vulnerability response.
- ✗
Increase logging and monitoring to detect exploitation attempts
Why it's wrong here
While increasing logging and monitoring is crucial for detecting exploitation attempts and aiding incident response, it serves as a detective control rather than a preventive one. This strategy does not actively stop the vulnerability from being exploited; it merely alerts administrators after an attack has potentially occurred or is in progress. For a known vulnerability, the primary goal should be to prevent exploitation, not just to observe it.
- ✓
Implement a Web Application Firewall (WAF) rule to block exploitation
Why this is correct
Implementing a Web Application Firewall (WAF) rule provides an effective 'virtual patching' solution by inspecting incoming traffic and blocking malicious requests targeting the known vulnerability before they reach the application. A WAF can be configured rapidly to identify and filter specific attack patterns, offering immediate protection without requiring modifications to the application's source code or the vulnerable library itself. This external layer of defense is a strong interim measure until a permanent fix can be deployed.
Go deeper
Related to this question
Learn chapter
Access Control Models and Mechanisms
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Web Application Firewall
A Web Application Firewall (WAF) is a security tool that monitors, filters, and blocks HTTP traffic to and from a web application to protect it from common attacks.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.