SY0-701 Question 187
Single answerInability to patchA hospital uses a legacy imaging system that controls MRI equipment. The vendor has not validated the latest operating system security patches, and applying them could interrupt patient care or void support. A recent vulnerability scan shows the system is missing several critical patches for remote code execution. The security administrator must reduce risk without patching the server immediately. Which of the following is the BEST compensating control to implement first?
- A
Place the imaging system on a dedicated network segment with tightly restricted firewall rules allowing only required management and application traffic
- B
Increase the system's password complexity requirements and force all technicians to change passwords every 30 days
- C
Disable logging on the server to reduce performance impact and avoid disrupting the imaging application
- D
Install a full feature update to the operating system during business hours so the vulnerability is removed as quickly as possible
Show answer and explanation
Correct answer: A
Explanation
The best answer is to isolate the unpatchable system and restrict communications to only what is operationally necessary. Inability to patch is common in legacy, medical, industrial, and other mission-critical environments where uptime, vendor certification, or safety requirements limit change. In these cases, compensating controls are used to reduce risk until patching or replacement is possible. Common best practices include network segmentation, host-based or network firewall restrictions, access control lists, jump servers, application allowlisting, enhanced logging, and continuous monitoring. This approach aligns with guidance from organizations such as NIST, including vulnerability management and industrial control system security recommendations that emphasize isolation and least functionality for systems that cannot be updated promptly.
- A. Correct.
Correct. When a critical system cannot be patched, network segmentation and strict access control are among the most effective compensating controls. Isolating the device on its own VLAN or protected subnet and allowing only necessary ports, protocols, and source systems reduces the attack surface and limits lateral movement. For unpatchable or unsupported systems, Security+ expects candidates to recognize compensating controls such as isolation, allowlisting, and restricted connectivity.
- B. Incorrect.
Incorrect. Strong passwords are helpful for general access control, but they do not directly mitigate an unpatched remote code execution vulnerability. A candidate might choose this because credential security is important, but this option does not address exploitation paths that do not require valid user credentials or that occur over exposed network services.
- C. Incorrect.
Incorrect. Disabling logging would weaken detective controls and make incident response more difficult. In environments with elevated risk from unpatched vulnerabilities, logging and monitoring should usually be increased, not reduced. This is a plausible distractor because administrators sometimes worry about application performance, but removing visibility is not a sound compensating control.
- D. Incorrect.
Incorrect. Applying unapproved patches to a medical or operational technology system during business hours is risky and contradicts the scenario constraints. The question states that patching could interrupt patient care or void vendor support. A candidate might pick this because patching is normally the preferred remediation, but here the issue is specifically an inability to patch immediately, so a compensating control is required first.