hardMultiple ChoiceObjective-mapped
SSCP Practice Question: The security analyst for a mid-sized e-commerce…
You are the security analyst for a mid-sized e-commerce company that processes credit card payments. The company uses a legacy payment application on a Windows Server 2012 R2 system, which is scheduled for decommission in six months. The server is isolated in a separate VLAN with strict firewall rules allowing only outbound HTTPS to the payment processor and inbound management from a jump box on a different subnet. During a routine vulnerability scan, you discover that the server is missing over 50 critical patches, including one for a remote code execution vulnerability (CVE-2023-XXXX) that is being actively exploited in the wild. The server cannot be patched because the vendor stopped support and patches are not available. The company's risk appetite is low due to PCI DSS requirements. You need to recommend a course of action that balances risk reduction with business continuity. What should you do?
⚠ Common exam trap
It's easy for candidates to choose Option B (immediate decommission) thinking it eliminates risk, but they overlook the business continuity requirement and the fact that PCI DSS allows compensating controls for legacy systems with a documented migration plan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement additional compensating controls such as an application-layer firewall, disable all unnecessary services, restrict outbound traffic to only the payment processor IP, enable detailed logging, and accelerate the migration
It implements compensating controls to reduce the risk of the unpatched remote code execution vulnerability while maintaining business continuity. By deploying an application-layer firewall (e.g., a WAF or host-based IPS), disabling unnecessary services, restricting outbound traffic to only the payment processor's IP via strict egress ACLs, enabling detailed logging for monitoring, and accelerating the migration to a supported system, you align with PCI DSS Requirement 6.2 (timely patching) and Requirement 11.5 (change detection) without causing an outage. This layered defense mitigates the active exploit risk until the legacy server can be decommissioned in six months.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement additional compensating controls such as an application-layer firewall, disable all unnecessary services, restrict outbound traffic to only the payment processor IP, enable detailed logging, and accelerate the migration
Why this is correct
Compensating controls reduce risk while allowing continued operation until decommission.
- ✗
Immediately decommission the server and migrate to the new payment system, accepting a temporary outage
Why it's wrong here
This would stop payment processing, causing significant business disruption.
- ✗
Apply the vendor's hotfix from an unofficial source to patch the vulnerability
Why it's wrong here
Unofficial patches may introduce new vulnerabilities and are not recommended.
- ✗
Accept the risk and purchase additional cyber insurance to cover potential losses
Why it's wrong here
Insurance transfers financial risk but does not prevent a breach that could compromise customer data and PCI compliance.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.