CAS-003 · Question #34
A recent penetration test identified that a web server has a major vulnerability. The web server hosts a critical shipping application for the company and requires 99.99% availability. Attempts to…
The correct answer is E. HIDS. The constraints are: cannot patch (would break the app), requires 99.99% availability, and will be replaced in three months. Option E (HIDS - Host-based Intrusion Detection System) provides host-level monitoring that can detect exploitation attempts, alert responders in…
Question
A recent penetration test identified that a web server has a major vulnerability. The web server hosts a critical shipping application for the company and requires 99.99% availability. Attempts to fix the vulnerability would likely break the application. The shipping application is due to be replaced in the next three months. Which of the following would BEST secure the web server until the replacement web server is ready?
Options
- APatch management
- BAntivirus
- CApplication firewall
- DSpam filters
- EHIDS
How the community answered
(38 responses)- A5% (2)
- B11% (4)
- D3% (1)
- E82% (31)
Explanation
The constraints are: cannot patch (would break the app), requires 99.99% availability, and will be replaced in three months. Option E (HIDS - Host-based Intrusion Detection System) provides host-level monitoring that can detect exploitation attempts, alert responders in real-time, and in many modern implementations include prevention capabilities (HIPS) to block suspicious process behaviors associated with exploitation. This adds a protective layer without modifying the application or creating outage risk. Option C (Application/Web Application Firewall) is also a strong candidate because it can filter malicious HTTP requests targeting the known vulnerability at the network edge. However, HIDS is selected here as it directly monitors the host itself and can respond to exploitation attempts regardless of how they enter. Option A (patch management) is explicitly ruled out. Option B (antivirus) does not address web server vulnerabilities. Option D (spam filters) is irrelevant to web server security.
Topics
Community Discussion
No community discussion yet for this question.