The organization does not have the time to remediate the vulnerability; however it is critical to release the application. Which of the following needs to be further evaluated to help mitigate the…

Question

Options

• AProvide developer security training
• BDeploy Intrusion Detection Systems
• CProvide security testing tools
• DImplement Compensating Controls

• A
  4% (2)
• B
  9% (4)
• C
  2% (1)
• D
  85% (39)

Explanation

Compensating Controls are the correct answer because when a vulnerability cannot be patched in time, you evaluate alternative safeguards that reduce the risk without fixing the root cause - for example, network segmentation, additional authentication layers, or increased monitoring around the vulnerable component.

Why the distractors are wrong:

• A (Security Training) addresses developer behavior long-term but does nothing to protect the application from an existing, known vulnerability right now.
• B (Intrusion Detection Systems) can detect attacks but are passive monitors - they don't prevent exploitation of the vulnerability.
• C (Security Testing Tools) help find vulnerabilities, but the question states the vulnerability is already known; more testing doesn't mitigate the risk.

Memory tip: Think of compensating controls as a splint, not surgery - you can't perform the operation (remediation) right now, so you stabilize the situation. Whenever an exam question mentions "no time to remediate" or "must release despite risk," the answer almost always involves compensating controls.

No community discussion yet for this question.