CS0-004 practice question 1 of 10

An incident response team identifies a malicious uniform resource locator (URL) associated with a required business process and performs the…

An incident response team identifies a malicious uniform resource locator (URL) associated with a required business process and performs the following activities: * Access to the URL has been restricted only to the necessary users through firewall rules and Cloud Security Group rules. * Additional monitoring has been enabled for traffic related to that site and the allowed users. * All application servers that need to access that site have been patched with the latest security and software updates. * Application owners have been notified of the severity and need to remediate this reported issue. Which of the following best describes the overall mitigation the security team is performing?

Answer options

A: Patching solutions

B: Configuration management

C: Compensating controls Correct answer

D: Attack surface management

Correct Answer:

C. Compensating controls

Explanation

The organization cannot completely block the malicious URL because it is strictly tied to a required business process. Instead, the security team implements alternative measures—such as restrictive firewall rules, enhanced monitoring, and aggressive patching—to mitigate the risk. These alternative measures are known as compensating controls. Compensating controls are deployed when a primary security control (in this case, outright blocking the malicious domain) cannot be implemented due to legitimate business or technical constraints, ensuring the residual risk remains at an acceptable level.

Why Incorrect

A. Patching is only one component of the response; it does not encompass the firewall restrictions and monitoring implemented to offset the inability to block the URL.
B. Configuration management refers to maintaining systems in a desired, consistent state, not the specific act of applying alternative security measures to mitigate an unblockable threat.
D. Attack surface management involves the continuous discovery and reduction of organizational vulnerabilities, whereas this scenario describes targeted incident response using alternative risk mitigation.

References

1. NIST Special Publication 800-53 Rev. 5, "Security and Privacy Controls for Information Systems and Organizations", Appendix A (Compensating Controls).

2. ISACA CISA Review Manual, 27th Edition, Section 1 (Information Systems Auditing Process - Compensating Controls).

Keep practicing

Take the free CS0-004 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test