Cyber Security Quiz: Compensating Controls
10 questions · exam conditions
0:00
Compensating ControlsQuestion 1 of 10

An organization plans to use an intrusion prevention system as a temporary virtual patch for a critical exploit against an internal web service. The load balancer passes TLS connections through without decryption, so the IPS can observe connection metadata but not HTTP requests.

What change is necessary for the IPS control to address the application-layer exploit as intended?

Increase the IPS signature-update frequency while retaining TLS passthrough at the load balancer.
Block the attacker's currently known IP addresses while retaining encrypted traffic through the IPS.
Enable full packet capture on the IPS and inspect the stored traffic after each security alert.
Decrypt traffic at an approved inspection point, apply the exploit signature, and re-encrypt traffic to the service.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Compensating Controls

Practice Compensating Controls in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Compensating Controls, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

An organization plans to use an intrusion prevention system as a temporary virtual patch for a critical exploit against an internal web service. The load balancer passes TLS connections through without decryption, so the IPS can observe connection metadata but not HTTP requests.

What change is necessary for the IPS control to address the application-layer exploit as intended?

  1. Increase the IPS signature-update frequency while retaining TLS passthrough at the load balancer.
  2. Block the attacker's currently known IP addresses while retaining encrypted traffic through the IPS.
  3. Enable full packet capture on the IPS and inspect the stored traffic after each security alert.
  4. Decrypt traffic at an approved inspection point, apply the exploit signature, and re-encrypt traffic to the service. (correct answer)
Explanation: Whenever you see a question about IPS-based virtual patching, ask yourself: can the IPS actually see the content it needs to inspect? A signature designed to catch an application-layer exploit must be able to read application-layer data — HTTP headers, request bodies, URL parameters. If that data is encrypted, the signature is blind. Here, the load balancer passes TLS connections through without decrypting them, meaning the IPS only sees encrypted ciphertext. No matter how well-tuned the exploit signature is, it cannot match against data it cannot read. The fix, as D describes, is to terminate TLS at an approved inspection point (typically the load balancer or a dedicated SSL/TLS inspection proxy), let the IPS inspect the plaintext HTTP traffic, then re-encrypt it before forwarding to the backend service. This "decrypt → inspect → re-encrypt" pipeline is the standard architecture for deep packet inspection in encrypted environments, and it's the only way the virtual patch can function as intended. Choice A is wrong because updating signatures more frequently doesn't solve the core visibility problem — you can have a perfect, up-to-date signature and still miss every attack if the traffic is opaque. Choice B fails for the same structural reason: IP blocking operates at Layer 3 and doesn't require payload visibility, but it isn't a reliable virtual patch against an application exploit, and it still doesn't address the encrypted-traffic blind spot. Choice C is a trap — offline forensic analysis of stored packets may help with incident response, but it provides no prevention; the exploit succeeds before any post-alert review can occur. When you see "IPS" and "TLS passthrough" together on an exam, that combination is almost always signaling a visibility gap that must be resolved before any signature-based control can work.

Question 2

A zero-day vulnerability affects the public service interface of a network appliance. The vendor advises restricting the management interface while a patch is developed. The organization's management interface is already reachable only from an administrative network, but the vulnerable public service remains accessible from the internet.

Which additional action most directly compensates for the identified exposure?

  1. Place the public service behind a controlled gateway or VPN and allow only the external users who require access. (correct answer)
  2. Further restrict the management interface to a single administrator workstation and enable verbose logging for all administrative sessions.
  3. Rotate all local administrator credentials on the appliance and disable any accounts that are not currently in active use.
  4. Run daily vulnerability scans against the administrative network and generate alerts whenever a new host can reach the management interface.
Explanation: When a zero-day exists on a publicly exposed service, the goal is to reduce the attack surface of the vulnerable component itself — not to harden adjacent systems. Think of it as compensating controls: since you can't patch the vulnerability yet, you limit who can even reach it. Answer A directly addresses this by placing the exposed public service behind a controlled gateway or VPN, restricting access to only those external users who legitimately need it. This shrinks the pool of potential attackers from "the entire internet" to a defined, authenticated group — directly compensating for the vulnerability's exposure while the patch is developed. Answer B is a trap. The management interface is already restricted to an administrative network, so tightening it further and adding verbose logging doesn't touch the actual problem — the vulnerable public service is still wide open. You're hardening something that wasn't the identified exposure. Answer C addresses credential hygiene, which is always good practice but completely orthogonal to a zero-day vulnerability in a public service. Rotating credentials doesn't prevent an unauthenticated attacker from exploiting a software flaw in the service itself. Answer D adds visibility through vulnerability scanning, but detection is not prevention. Knowing when a new host reaches the management interface doesn't reduce the internet-facing attack surface of the vulnerable public service. Monitoring a different component while the real exposure remains open is not compensation. Study tip: On questions about compensating controls, always trace the action back to the specific exposed component. Ask yourself: "Does this action reduce access to the vulnerable thing?" If the action targets something else, it's a distractor.

Question 3

A patch for a local privilege-escalation vulnerability cannot be installed on engineering workstations until a specialized driver is validated. Exploitation requires an attacker to execute code as a standard user first; the vulnerability is not remotely exploitable by itself.

Which interim approach best addresses the vulnerability's actual exploitation path?

  1. Block the vulnerable operating-system version at the internet firewall and increase the frequency of external port scanning on the engineering subnet.
  2. Require longer and more complex local administrator passwords and remove the workstation hostnames from internal DNS query responses.
  3. Restrict interactive access, enforce application allowlisting, and use endpoint controls to detect privilege-escalation behavior. (correct answer)
  4. Move engineering documents to encrypted network storage and increase the frequency of workstation image backups to support rapid recovery.
Explanation: When a vulnerability requires local code execution as a prerequisite, the smart interim strategy is to cut off that prerequisite — deny the attacker the foothold they need before privilege escalation ever becomes possible. This question tests whether you can map controls to an attack's actual exploitation chain rather than applying generic security measures. Option C directly addresses how this attack works. Since exploitation requires a standard user to execute code locally first, restricting interactive access limits who can even reach that starting point. Application allowlisting prevents unauthorized code from running at all, eliminating the attacker's ability to launch a privilege-escalation payload. Endpoint detection for privilege-escalation behavior adds a monitoring layer to catch attempts that slip through. Together, these controls attack every step of the exploitation path. Option A is a misdirection — the vulnerability is explicitly not remotely exploitable, so blocking it at the internet firewall does nothing. External port scanning addresses network exposure, not local privilege escalation. Option B targets password complexity and DNS visibility, which are unrelated to this attack path. A stronger admin password doesn't prevent a standard user from running a local exploit, and hiding hostnames from DNS provides no meaningful protection here. Option D focuses on document protection and recovery rather than prevention — backups help you recover after a compromise but do nothing to stop the privilege-escalation from occurring. Your study tip: when a vulnerability has a required precondition (like "attacker must already execute code locally"), always identify controls that eliminate that precondition first. The best interim mitigations sever the earliest link in the attack chain.

Question 4

A database extension contains an unpatched vulnerability that allows an authenticated database user to execute commands with the database service account's operating-system privileges. The extension cannot be disabled because a business application uses it. Only one application service account needs permission to invoke the extension.

Which control combination most directly reduces the exploit's prerequisites and potential impact?

  1. Revoke extension access from other accounts, restrict the application account's login sources, and reduce the database service account's OS privileges. (correct answer)
  2. Encrypt all database backups, rotate the backup encryption key on a weekly schedule, and store an additional verified copy in an isolated recovery environment.
  3. Increase database audit logging, forward all extension invocation events to the SIEM, and triage resulting alerts at the start of each business day.
  4. Migrate the database listener to a nonstandard port, suppress the service version banner, and update the asset inventory to reflect the new configuration.
Explanation: When a vulnerability has specific prerequisites (who can trigger it) and impact (what damage results), the strongest controls are those that shrink both attack surfaces simultaneously — not just detect or obscure the problem. Answer A directly attacks both dimensions. Revoking extension access from unnecessary accounts means fewer principals can trigger the vulnerability in the first place — that's reducing prerequisites. Restricting the application account's login sources (e.g., limiting it to specific hosts or subnets) adds another barrier an attacker must clear. Finally, reducing the database service account's OS privileges limits the blast radius if the vulnerability is exploited — an attacker gains fewer system-level capabilities. Together, these controls are precisely scoped to the described threat. Answer B addresses backup integrity and recovery, which is relevant to availability and data protection after a breach — but does nothing to prevent exploitation or limit an attacker's OS-level access during an active incident. It's a resilience control, not a threat-reduction control. Answer C improves detection and response time, which has value, but logging does not prevent exploitation. An attacker can still fully compromise the OS-level account before any alert is triaged the next morning. Detection is not protection. Answer D employs security-through-obscurity tactics. Moving a port or hiding a version banner may slow unsophisticated attackers but doesn't remove the vulnerability, restrict who can invoke the extension, or limit what a successful exploit can do. The study tip here: when a question asks about reducing prerequisites and impact, look for controls that map to access restriction (fewer people can try) and privilege reduction (less damage if they succeed) — that pairing is the hallmark of a least-privilege defense.

Question 5

A security team deploys a new IPS signature as a compensating control for an unpatched server vulnerability. During a controlled test, the exploit reaches the server and succeeds. The IPS generates a high-severity alert, but its policy is configured for detection only.

Which conclusion and next action are most appropriate?

  1. The control is effective because it detected the exploit; retain alert-only mode and shorten the incident-response target.
  2. The control is effective if the alert reaches the SIEM; close the exception after confirming log retention.
  3. The control failed only because the server was unpatched; suppress further tests until the maintenance window.
  4. The control is not preventive as configured; test blocking mode for stability and then monitor enforcement continuously. (correct answer)
Explanation: When evaluating security controls, you must distinguish between detection and prevention — two fundamentally different functions. A compensating control deployed against an unpatched vulnerability needs to actually stop the exploit, not just observe it. The moment an exploit "reaches the server and succeeds," you know the control provided zero protective value in that scenario, regardless of what alerts it generated. D is correct because it accurately diagnoses the problem: the IPS is configured in detection-only mode, meaning it never had the authority to block anything. The alert firing is irrelevant to whether the server was protected. The right next step is to test blocking mode carefully (to catch any stability or false-positive issues), then enforce it — turning detection into actual prevention. A is the most tempting trap. It conflates visibility with protection. Detecting an exploit that already succeeded is not a security win — it's a forensics capability. Shortening incident-response time doesn't compensate for a control that lets the attack complete. B compounds that mistake by shifting focus to log retention and SIEM integration. Whether the alert was forwarded to the SIEM is a logging question, not a control-effectiveness question. The exploit still succeeded. C misdirects blame onto the unpatched server, which is a pre-existing condition the IPS was specifically deployed to compensate for. Suppressing further tests ignores the real gap and leaves the organization blind to ongoing risk. Your takeaway: on security exam questions, always ask "Did the attack succeed?" If yes, the control failed its protective purpose — no matter how many alerts it generated. Detection ≠ prevention.

Question 6

A security team cannot patch a high-risk vulnerability before the remediation deadline. Network restrictions and application allowlisting have been tested and approved as temporary compensating controls. A manager proposes closing the vulnerability ticket because the controls lowered the current risk.

Which treatment of the vulnerability is most appropriate?

  1. Close the finding as remediated because a tested compensating control is operational and approved by management.
  2. Keep the finding tracked, document residual risk and control ownership, and set review and expiration dates tied to patching. (correct answer)
  3. Lower the scanner's technical severity rating so future reports reflect the protection supplied by the temporary controls.
  4. Delete the affected asset from routine scans and create a new ticket only if the compensating control later fails.
Explanation: When a vulnerability can't be patched on time, you're not choosing between "fixed" and "ignored" — you're choosing how to responsibly manage residual risk. This question tests your understanding of risk treatment and vulnerability lifecycle management, where compensating controls buy time but don't eliminate the underlying weakness. The right approach is B. A compensating control reduces current exploitability, but the vulnerability still exists. Best practice requires keeping the ticket open, documenting what residual risk remains, recording who owns the control, and setting mandatory review and expiration dates tied to the actual patch. This preserves accountability and ensures the temporary fix doesn't quietly become permanent. A is the trap the question is designed for. Closing the ticket because a compensating control is in place confuses risk reduction with remediation. The vulnerability isn't patched — it's mitigated. Closing it drops it off tracking dashboards, creating dangerous blind spots if the control degrades or fails. C is a form of data manipulation. Lowering the scanner's severity rating obscures the true technical risk from future analysts and auditors. Controls don't change the intrinsic severity of a CVE — they change your exposure, not the vulnerability's inherent danger. D compounds the problem by removing the asset from visibility entirely. Deleting it from scans means no one is watching whether the compensating control holds. You'd only know it failed after an incident — exactly the outcome you're trying to prevent. A useful rule: compensating controls pause the clock on risk, they don't stop it. Any vulnerability managed this way should stay tracked until the underlying flaw is actually resolved.

Question 7

A remote-code-execution vulnerability affects a print service enabled by default on a group of application servers. The servers have no printing requirement. Emergency patching would require an outage that the business cannot approve until the next maintenance window.

Which response is the strongest compensating control until the patch can be installed?

  1. Leave the print service running, block its port at the perimeter firewall, and increase operating-system log retention.
  2. Change the print service to a nonstandard port, restrict access to internal DNS names, and scan it each week.
  3. Disable the print service, enforce that state through configuration management, and alert if the service is re-enabled. (correct answer)
  4. Stop the print service once, document the action in the change ticket, and defer further verification until patching.
Explanation: When a vulnerability cannot be patched immediately, your goal is to eliminate the attack surface entirely rather than merely reduce visibility into it. Questions like this are testing your understanding of compensating controls — temporary safeguards that provide equivalent protection to the missing patch. The strongest compensating control here is C: disabling the print service removes the vulnerable code from execution entirely, meaning there is nothing for an attacker to exploit. Enforcing that state through configuration management (like Group Policy or Ansible) prevents accidental or malicious re-enablement, and alerting on drift closes the loop with continuous verification. This trio — remove, enforce, monitor — mirrors the "defense in depth" and "least functionality" principles central to frameworks like NIST SP 800-53. A is tempting but dangerously incomplete. A perimeter firewall block leaves the service running and accessible from inside the network — a critical gap, since many attacks originate internally or pivot laterally after an initial breach. Increasing log retention is purely reactive and adds no prevention. B compounds the problem by keeping the vulnerable service alive. Moving it to a nonstandard port is "security through obscurity," which security professionals explicitly reject as a standalone control. Weekly scanning only tells you if you've already been compromised. D is the weakest option. Stopping the service once without enforcement means it can restart automatically after a reboot, after an update, or through misconfiguration — with no mechanism to catch it. Study tip: On security exams, when an answer removes the threat vector entirely and verifies that removal continuously, it will almost always outrank answers that merely hide or observe the vulnerability.

Question 8

A compatibility problem prevents immediate deployment of a patch for a remotely exploitable SMB vulnerability on employee workstations. Users do not need to accept inbound SMB connections from other workstations, but a designated management server requires SMB access for software distribution.

Which temporary control best reduces both initial exploitation and workstation-to-workstation propagation while preserving the required function?

  1. Block all SMB traffic at the internet firewall while continuing to permit unrestricted SMB communication inside the network.
  2. Disable SMB on the management server and permit workstations to initiate SMB sessions with any internal destination.
  3. Use host firewalls to permit inbound SMB only from the management server and deny it from all other sources. (correct answer)
  4. Retain the current SMB rules but increase endpoint log retention and scan the workstations more frequently.
Explanation: When a patch can't be deployed immediately, your goal shifts to compensating controls — mechanisms that reduce risk without fixing the root vulnerability. For network-based threats like an SMB exploit, the most powerful compensating controls combine limiting attack surface with containing lateral movement, while preserving legitimate business functions. Option C achieves all three objectives. By configuring host-based firewall rules to allow inbound SMB only from the management server, you eliminate the attack vector from any other source — including a compromised peer workstation trying to spread the exploit laterally. The management server retains its software distribution capability, satisfying the operational requirement. This is the principle of least privilege applied at the network layer: every workstation accepts exactly as much SMB traffic as it needs, and nothing more. Option A fails because blocking SMB only at the internet perimeter ignores that most SMB exploits and worm-style propagation travel east-west inside the network, not inbound from the internet. Internal threats are left completely unrestricted. Option B makes things worse by disabling SMB on the management server — the one host that legitimately needs it — while leaving workstations free to initiate SMB sessions with any internal target, which is the exact behavior that enables lateral movement. Option D is purely detective, not preventive; increased logging and scanning may help you notice a breach faster, but they do nothing to block exploitation or propagation in the first place. The key pattern to remember: when a question asks for a temporary control that both blocks exploitation and limits spread, look for the answer that applies granular, directional access control at the host level — not just the perimeter.

Question 9

A public-facing order application contains a confirmed SQL injection vulnerability. The vendor patch cannot be installed for three weeks because it breaks a required payment module. The application must remain available, and its HTTPS traffic already terminates at a reverse proxy before reaching the application.

Which interim action would provide the most appropriate compensating control?

  1. Increase database backups to hourly intervals and alert administrators whenever a backup job fails.
  2. Apply a route-specific WAF rule at the reverse proxy, test it against exploit attempts, and monitor blocked requests. (correct answer)
  3. Run authenticated vulnerability scans each night and escalate any increase in the vulnerability's severity score.
  4. Enable detailed database query logging and review unusual statements during the weekly security operations meeting.
Explanation: When a vulnerability can't be patched immediately, the goal of a compensating control is to actively block exploitation while the permanent fix is pending — not merely to improve visibility or disaster recovery. The key distinction here is between controls that prevent an attack and controls that only detect or recover from one. Because HTTPS traffic already terminates at a reverse proxy, you have a perfect insertion point for a Web Application Firewall (WAF) rule. Option B leverages this existing architecture by applying a targeted rule that inspects and blocks SQL injection payloads before they ever reach the vulnerable application. Critically, it includes testing against known exploit patterns and active monitoring — meaning it's both validated and operationally maintained. This is the textbook definition of an effective compensating control: it reduces risk in real time without requiring the broken patch. Option A improves your recovery posture by increasing backup frequency, but backups do nothing to stop an attacker from exfiltrating data or corrupting records right now. It addresses aftermath, not prevention. Option C — running nightly vulnerability scans — only tells you the vulnerability still exists; scanning never blocks a single request. Escalating a severity score is awareness, not defense. Option D enables logging and schedules review at a weekly meeting. Logging is valuable for forensics, but reviewing logs weekly means an active attack could persist for days undetected and completely unblocked. A useful pattern to remember: on security exam questions about compensating controls, prioritize options that interrupt the attack path over options that improve monitoring or recovery. If traffic already flows through a proxy or gateway, a filtering rule at that chokepoint is almost always the strongest interim answer.

Question 10

An unpatched file-server vulnerability could allow an attacker to encrypt files, copy sensitive records, and disrupt operations. The organization has immutable backups that are isolated from the production network and successfully tested each quarter.

How should the backup capability be characterized when selecting compensating controls?

  1. It fully compensates for the vulnerability because immutable copies prevent permanent loss of production data.
  2. It reduces recovery impact but does not prevent exploitation or disclosure, so preventive controls are still needed. (correct answer)
  3. It prevents ransomware execution because an attacker cannot modify backup copies from the production network.
  4. It removes confidentiality risk if restoration testing confirms that all encrypted files can be recovered successfully.
Explanation: When evaluating compensating controls, you need to think across all three pillars of the CIA triad — confidentiality, integrity, and availability — not just one. A backup strategy addresses availability (recovering lost or encrypted data), but you must ask whether it also addresses confidentiality (preventing data exposure) and whether it stops an attack or simply helps you recover from one. The correct answer is B because immutable, isolated backups genuinely reduce recovery impact — ransomware cannot permanently destroy your data if clean copies exist. However, backups are a recovery control, not a preventive one. The attacker can still exploit the unpatched vulnerability, encrypt production files, and — critically — exfiltrate sensitive records before encryption begins. That data exposure is a confidentiality breach no backup can undo. A is wrong because "fully compensates" overstates the backup's role. Backups restore availability but do nothing to prevent exploitation or stop data theft from occurring in the first place. "Fully" is a red flag word here. C is a subtle trap. Immutable backups mean attackers can't modify the backup copies, but that says nothing about preventing ransomware from executing on the production environment. The attack still happens — the backups just aren't affected by it. D is wrong because successful restoration testing confirms recoverability of encrypted production files, but it cannot retroactively erase the confidentiality risk if sensitive records were already copied and exfiltrated during the attack. Study tip: On security exams, watch for controls that only address one CIA pillar being presented as a complete solution. Always ask: "What threats does this control not address?"