2.5 - Mitigation techniques
Security+ SY0-701 objective 2.5 covers techniques that reduce the risk of vulnerabilities and attacks. Timely patching and updates is the single most effective mitigation for known software vulnerabilities. Application allow-listing permits only a pre-approved list of programs to run on endpoints, blocking everything else by default. When a critical vulnerability is found but no patch exists yet, the best interim step is to apply a compensating control that limits the exposure, such as segmentation or extra monitoring. Developers can catch flaws early with static analysis (SAST) that reviews source code before the app runs. Other mitigations include hardening, least privilege, network segmentation, decommissioning, configuration enforcement and encryption. Expect scenario questions that describe a weakness or constraint and ask for the best mitigation, especially when no patch is yet available.
Best fix for known flaws = timely patching. Only approved programs run = application allow-listing. Critical flaw, no patch yet = compensating control. Find flaws in source before run = static analysis (SAST).
Practice questions
1. What is the most effective mitigation for known software vulnerabilities?
- Enforcing longer passwords
- Timely patching and updates (correct answer)
- Adding more network bandwidth
- Turning off system logging
Patch management closes known vulnerabilities before they're exploited. Combine with hardening, least privilege and segmentation.
2. Allowing only a pre-approved list of programs to run on endpoints is called:
- Blocklisting bad files
- Application allow-listing (correct answer)
- Sandboxing all apps
- Disabling the firewall
Allow-listing (whitelisting) permits only approved software and blocks everything else — strong against unknown/zero-day malware but higher management overhead.
3. A critical vulnerability is found but no patch exists yet. Which is the BEST interim mitigation?
- Ignore it until a patch ships
- Publicly post the exploit details
- Apply a compensating control (correct answer)
- Disable all system logging
When no patch exists, apply a compensating control (segmentation, WAF rule, disable the feature, tighter access) to reduce risk until a fix is available.
4. A developer wants to catch flaws by analyzing source code before the app runs. This testing is:
- Dynamic analysis (DAST)
- Static analysis (SAST) (correct answer)
- A live penetration test
- A user acceptance test
SAST inspects source code without running it, catching flaws early. DAST tests the running app from the outside; IAST combines both with instrumentation.
5. The BEST way to stop SQL injection in application code is to:
- Hide errors from the user
- Use parameterized queries (correct answer)
- Rename the database tables
- Increase the query timeout
Parameterized queries (prepared statements) separate code from data so input can't alter the query. Add input validation and least-privilege DB accounts as defense in depth.
6. A vuln scan lists 300 findings. To fix the riskiest first, prioritize primarily by:
- Alphabetical finding name
- The order they were found
- Severity and exploitability (correct answer)
- The scan's completion time
Prioritize remediation by severity/CVSS and real exploitability plus asset exposure/criticality, not discovery order. Focus effort where risk to the business is highest.