SY0-701 Question 184
Single answerPatch availabilityA security administrator learns that a critical remote code execution vulnerability affects the company's internet-facing VPN appliance. The vendor has confirmed the issue, but no patch is available yet. Management wants the fastest action that best reduces risk until an official fix is released. Which action should the administrator take FIRST?
- A
Implement vendor-recommended mitigations such as restricting management access, disabling the vulnerable feature if possible, and increasing monitoring for exploitation attempts
- B
Wait for the official patch so the organization does not introduce operational changes that could affect availability
- C
Run an authenticated vulnerability scan every hour against the appliance until the patch is released
- D
Replace the VPN appliance immediately with a different vendor's product to eliminate the exposure
Show answer and explanation
Correct answer: A
Explanation
This question tests patch availability decision-making. In Security+ scenarios, if a vulnerability is known but a patch is unavailable, the appropriate response is to use compensating controls and vendor guidance to reduce exposure until remediation is possible. Common best practices include disabling vulnerable services or features, restricting access with ACLs or firewall rules, limiting management interfaces, increasing logging, monitoring for indicators of compromise, and isolating affected systems where feasible. This approach is consistent with general guidance from vendors, CISA advisories, and NIST vulnerability management practices: organizations should assess exposure, prioritize internet-facing and critical assets, and implement temporary mitigations when patches are not yet released. Waiting passively or relying only on scanning does not adequately address active risk.
- A. Correct.
Correct. When a patch is not yet available, the best immediate response is to apply compensating controls and any vendor-recommended mitigations. In a real environment, this can include limiting exposure, disabling affected functionality, restricting administrative access, applying temporary configuration changes, and increasing logging and monitoring. This aligns with standard vulnerability management practice: reduce attack surface and likelihood of exploitation while waiting for a tested vendor fix.
- B. Incorrect.
Incorrect. Waiting for a patch without taking interim action leaves the system exposed, especially for an internet-facing device with a critical remote code execution vulnerability. A common misconception is that avoiding change is the safest path, but in this case inaction increases security risk.
- C. Incorrect.
Incorrect. More frequent scanning may improve visibility, but it does not meaningfully reduce the immediate likelihood of exploitation. It is a detection activity, not a primary mitigation. Candidates might choose this because scanning is part of vulnerability management, but it is not the first or best risk-reduction step when no patch exists.
- D. Incorrect.
Incorrect. Replacing the entire appliance may eventually reduce risk, but it is rarely the fastest or most practical first action. Procurement, migration, and cutover take time and can introduce new operational issues. Security+ emphasizes immediate, practical mitigation steps before large strategic changes.