nerdexam
CompTIA

CAS-002 · Question #871

A critical system audit shows that the payroll system is not meeting security policy due to missing OS security patches. Upon further review, it appears that the system is not being patched at all…

The correct answer is A. Isolate the system on a secure network to limit its contact with other systems. When OS patches cannot be applied due to vendor support constraints, network isolation serves as the standard compensating control to limit exposure.

Enterprise Security

Question

A critical system audit shows that the payroll system is not meeting security policy due to missing OS security patches. Upon further review, it appears that the system is not being patched at all. The vendor states that the system is only supported on the current OS patch level. Which of the following compensating controls should be used to mitigate the vulnerability of missing OS patches on this system?

Options

  • AIsolate the system on a secure network to limit its contact with other systems
  • BImplement an application layer firewall to protect the payroll system interface
  • CMonitor the system's security log for unauthorized access to the payroll application
  • DPerform reconciliation of all payroll transactions on a daily basis

How the community answered

(47 responses)
  • A
    83% (39)
  • B
    4% (2)
  • C
    2% (1)
  • D
    11% (5)

Why each option

When OS patches cannot be applied due to vendor support constraints, network isolation serves as the standard compensating control to limit exposure.

AIsolate the system on a secure network to limit its contact with other systemsCorrect

Isolating the system on a secure network segment reduces its attack surface by restricting which systems can communicate with it, effectively compensating for missing OS patches by limiting the vectors through which unpatched vulnerabilities could be exploited.

BImplement an application layer firewall to protect the payroll system interface

An application layer firewall protects the payroll application interface but does not address OS-level vulnerabilities that remain exposed due to missing patches.

CMonitor the system's security log for unauthorized access to the payroll application

Monitoring security logs is a detective control that identifies unauthorized access after the fact, not a preventive compensating control for the underlying patch vulnerability.

DPerform reconciliation of all payroll transactions on a daily basis

Daily payroll reconciliation addresses financial accuracy and fraud detection, not the security risk posed by missing OS patches.

Concept tested: Compensating controls for unpatched legacy systems

Source: https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final

Topics

#compensating controls#network isolation#unpatched systems#risk mitigation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice