Match each mitigation to the vulnerability it actually closes

applied · 75 min · Objective 2.5

Task

Take eight findings, choose a mitigation for each, then justify why the three most plausible alternatives would not have closed it. Choosing correctly is easy; explaining why the near-miss is wrong is what the exam tests.

Steps

  1. Write /tmp/findings.md with eight findings drawn from this domain: a flat network after lateral movement, an unpatchable appliance, accumulated permissions from role changes, unknown malware executing, hosts drifting from the build standard, vendor defaults still in place, a known CVE with a fix available, and an unowned server.
  2. For each, name the mitigation you would apply from CompTIA's list: segmentation, access control, application allow listing, isolation, configuration enforcement, hardening, patching, decommissioning.
  3. Now the part that matters: for each finding, name the three most tempting WRONG answers and write one sentence each on why they do not close it.
  4. Identify the two findings where 'patch it' is the wrong answer, and state which of the four reasons from the lesson applies.
  5. Build /tmp/matrix.csv as finding,mitigation,wrong1,why1,wrong2,why2,wrong3,why3 so the reasoning is machine-checkable.
  6. Check your own work: no mitigation should appear as the right answer more than twice, or you have collapsed distinct findings into one.

Verify

python3 - <<'PY'
import csv,collections
rows=list(csv.DictReader(open('/tmp/matrix.csv')))
assert len(rows)>=8, 'fewer than eight findings'
c=collections.Counter(r['mitigation'].strip().lower() for r in rows)
print('mitigations used:',dict(c))
assert max(c.values())<=2, 'one mitigation is the answer to more than two findings'
for r in rows:
    for k in ('why1','why2','why3'):
        assert len(r[k].strip())>15, 'a rejection in '+r['finding'][:30]+' is not explained'
print('eight findings, each with three explained rejections')
PY
grep -ciE "no patch|cannot be applied|not a vulnerability|still active" /tmp/findings.md

The assertions do the work: at least eight findings, no mitigation over-used, and every rejection actually explained rather than left blank. The grep must be at least two — you identified the cases where patching is the wrong answer and said which reason applies.

Notes

The over-use check is there because segmentation and monitoring are the comfortable answers, and a matrix where six findings resolve to 'segment it' has stopped distinguishing between the findings. If that happened, the findings were too similar — rewrite them.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.