An incident response team identifies a malicious uniform resource locator (URL) associated with a required business process and performs the…

The organization cannot completely block the malicious URL because it is strictly tied to a required business process. Instead, the security team implements alternative measures—such as restrictive firewall rules, enhanced monitoring, and aggressive patching—to mitigate the risk. These alternative measures are known as compensating controls. Compensating controls are deployed when a primary security control (in this case, outright blocking the malicious domain) cannot be implemented due to legitimate business or technical constraints, ensuring the residual risk remains at an acceptable level.

A. Patching is only one component of the response; it does not encompass the firewall restrictions and monitoring implemented to offset the inability to block the URL.

B. Configuration management refers to maintaining systems in a desired, consistent state, not the specific act of applying alternative security measures to mitigate an unblockable threat.

D. Attack surface management involves the continuous discovery and reduction of organizational vulnerabilities, whereas this scenario describes targeted incident response using alternative risk mitigation.

1. NIST Special Publication 800-53 Rev. 5, "Security and Privacy Controls for Information Systems and Organizations", Appendix A (Compensating Controls).

2. ISACA CISA Review Manual, 27th Edition, Section 1 (Information Systems Auditing Process - Compensating Controls).