SY0-701 Question 301
Single answerVulnerability response and remediation: Patching , Insurance , Segmentation , Compensating controls , Exceptions and exemptionsA hospital's security team identifies a critical remote-code-execution vulnerability on a legacy radiology server that processes imaging data for patient care. The vendor has confirmed that no patch is currently available, and replacing the system will take several months due to regulatory validation requirements. The server must remain operational, but the risk of compromise is unacceptable in its current state. Which action should the security team take FIRST to most appropriately address the vulnerability while aligning with sound remediation practices?
- A
Purchase cyber insurance immediately and continue operating the server normally until a patch is released
- B
Create a documented risk exception and accept the vulnerability because the system is required for patient care
- C
Isolate the server in a restricted network segment and apply compensating controls such as tightly limited firewall rules and enhanced monitoring
- D
Disable all logging on the server to reduce performance impact and avoid service interruption during exploitation attempts
Show answer and explanation
Correct answer: C
Explanation
The best answer is to isolate the vulnerable system and apply compensating controls. In vulnerability response and remediation, patching is preferred when available, but when no patch exists and the asset must stay online, organizations should reduce exposure through segmentation, firewall restrictions, access control, and continuous monitoring. This aligns with common security best practices such as defense in depth, least privilege, and risk treatment through mitigation. A formal exception may still be needed for governance purposes, but it should not replace technical risk reduction. Cyber insurance can be part of overall risk management, but it is not a substitute for remediation or mitigation. Guidance from NIST vulnerability and risk management practices, including compensating safeguards and ongoing monitoring, supports implementing interim controls when immediate patching is not possible.
- A. Incorrect.
This is incorrect. Cyber insurance may help transfer some financial risk after an incident, but it does not remediate the vulnerability or reduce the likelihood of exploitation. Insurance is not a technical control and should not be the first response to an actively exposed critical vulnerability.
- B. Incorrect.
This is incorrect. A documented exception or exemption may be part of governance when immediate remediation is not possible, but simply accepting the risk without first implementing reasonable safeguards is poor security practice. Exceptions should typically be time-bound, formally approved, and paired with compensating controls when feasible.
- C. Correct.
This is correct. When patching is not immediately possible, segmentation and compensating controls are appropriate first steps to reduce exposure. Restricting network access, limiting allowed communications, and increasing monitoring can significantly reduce exploitability while the organization pursues a long-term fix or replacement. This is a practical vulnerability response approach for critical legacy systems that must remain online.
- D. Incorrect.
This is incorrect. Disabling logging weakens detection and incident response capabilities and does nothing to reduce the underlying vulnerability. In a high-risk scenario, enhanced logging and monitoring are generally more appropriate, not less.