A legacy IIS server has a critical unpatched remote code execution vulnerability, and the application team cannot take it offline for patching this week. Which compensating control best reduces exploitability while the fix is pending?

A compensating control should reduce the likelihood of exploitation when the primary fix, patching, is not yet possible. The vulnerability here is remote code execution in a web server that must stay online, so the attack arrives in HTTP requests that legitimate users also send. A web application firewall sits in that path, inspects requests and blocks known exploit patterns, which is often called virtual patching and directly lowers exploitability while the service remains available. Moving the server to a new VLAN but keeping the same inbound firewall rules changes addressing without changing who can reach the vulnerable service, so the exposure is unchanged. Raising SIEM alerting sensitivity improves detection but does nothing to prevent the exploit from succeeding. An authenticated rescan confirms the finding, which is useful hygiene but is not a control at all. On the exam, separate controls that prevent exploitation from those that only detect it or verify it, and prefer the one that acts on the actual attack path. Operationally, enable the WAF rule set or a vendor signature for the specific CVE, test it in blocking mode against the application, document it as a time-limited exception, and remove it only after the patch is verified.