mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: During a vulnerability scan, a security analyst…
During a vulnerability scan, a security analyst discovers that a web server is running an outdated version of Apache with known remote code execution vulnerabilities. The server is in production and cannot be patched immediately due to dependency conflicts. What is the best compensating control to reduce risk while a permanent fix is developed?
⚠ Common exam trap
ISC2 often tests the distinction between detective controls (logging/alerting) and preventive controls (WAF), leading candidates to choose logging because it seems proactive, but it fails to reduce risk in real time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a web application firewall (WAF) to block known attack patterns
A Web Application Firewall (WAF) is the best compensating control because it can inspect HTTP/HTTPS traffic at the application layer (Layer 7) and block known attack patterns targeting the outdated Apache version, such as specific payloads for CVE-2017-9798 or CVE-2021-41773. Unlike other options, a WAF provides virtual patching without modifying the vulnerable server, directly mitigating the remote code execution risk while a permanent fix is developed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable all unnecessary modules and services on the server
Why it's wrong here
While disabling unnecessary modules and services is a fundamental security hardening practice that reduces the overall attack surface, it does not directly remediate a specific, known vulnerability discovered during a scan. If the vulnerability resides within an essential, active service or module, simply disabling others will not prevent exploitation of that particular flaw. This action is proactive but not a targeted fix for an identified vulnerability.
- ✓
Implement a web application firewall (WAF) to block known attack patterns
Why this is correct
Implementing a Web Application Firewall (WAF) is an effective immediate mitigation because it can inspect HTTP/S traffic and block requests matching known exploit signatures or anomalous patterns targeting the discovered vulnerability. This acts as a "virtual patch," protecting the application from exploitation without requiring immediate code changes or server downtime. A WAF provides crucial time for developers to properly patch the underlying software, making it the most direct and rapid protective measure.
- ✗
Enable detailed logging and alerting for the server
Why it's wrong here
Enabling detailed logging and alerting is a critical component of a robust security monitoring strategy, providing visibility into potential attack attempts and system anomalies. However, this action is purely a detective control; it helps identify when an attack is occurring or has occurred, but it does not actively prevent the exploitation of the discovered vulnerability itself. While essential for incident response, it offers no preventative barrier.
- ✗
Isolate the server in a separate VLAN with strict ACLs
Why it's wrong here
Isolating the server in a separate VLAN with strict Access Control Lists (ACLs) is a valuable network segmentation strategy that can limit the lateral movement of an attacker and contain potential breaches. However, if the vulnerable service on the server remains accessible to legitimate users or other necessary systems, this segmentation alone will not prevent direct exploitation of the discovered vulnerability. The attack vector is still present, merely within a more controlled network segment.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Compensating control
A compensating control is a security measure implemented to reduce risk when a primary control cannot be used or is insufficient.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.