100-160 Question 171
Select 3During a routine vulnerability assessment, a cybersecurity technician discovers a critical vulnerability in a legacy server that cannot be patched due to compatibility issues. The server hosts a critical application that cannot be immediately migrated. Which of the following actions should the technician prioritize to manage this risk effectively?
- A
Implement network segmentation to isolate the server from unnecessary traffic.
- B
Disable the server immediately to eliminate the risk.
- C
Apply compensating controls, such as strict access controls and monitoring.
- D
Document the vulnerability and notify the management team.
- E
Upgrade the operating system of the server to resolve the vulnerability.
Show answer and explanation
Correct answers: A, C, D
Explanation
When a critical vulnerability cannot be patched due to compatibility issues, the priority is to manage the risk through compensating controls (e.g., network segmentation, access controls) and proper documentation to inform stakeholders. Disabling the server is not practical as it impacts business operations, and upgrading the operating system is not immediately feasible in this scenario.
- A. Correct.
Implementing network segmentation is an effective way to limit the exposure of the vulnerable server to potential threats. This is a practical compensating control when patching is not possible.
- B. Incorrect.
Disabling the server is not a feasible solution as it hosts a critical application, and doing so would disrupt business operations.
- C. Correct.
Applying compensating controls like access restrictions and monitoring can reduce the risk of exploitation while the long-term solution is planned.
- D. Correct.
Documenting the vulnerability and notifying management ensures that the risk is communicated to stakeholders and included in risk management planning.
- E. Incorrect.
Upgrading the operating system would resolve the issue, but the scenario specifies that the server cannot be patched or immediately migrated, so this is not an immediate solution.