A vendor patch for a city payment appliance is delayed, so security segments the device and documents a time-bound exception while continuing to pursue the patch. Which remediation approach does this describe?
Select an answer to reveal the explanation.
Short Explanation
When the patch truck is late, you still fence off the risky box and write down the temporary exception—like closing a lane and posting a detour. Patch first when you can; compensate and document when you cannot.
Full Explanation
Sound municipal remediation prefers vendor patches when they exist, applies compensating controls when they do not yet, and documents time-bound, approved exceptions so risk remains visible and owned. Segmenting the delayed payment appliance reduces blast radius and citizen payment exposure while the team continues pursuing the vendor fix—exactly the “patch when available, compensate and document meanwhile” pattern Security+ associates with incomplete remediation windows.
Deleting the appliance from inventory only hides the finding; it does not reduce vulnerability and breaks asset management. Accepting unlimited public exposure until a patch appears is unmanaged risk acceptance without mitigation. Disabling monitoring so auditors cannot see unpatched risk conceals rather than treats the problem and violates continuous monitoring expectations.
Exam caveat: exceptions must be approved, dated, and revisited—indefinite silent risk is not an exception process. Compensating controls (segmentation, stricter ACLs, enhanced logging) buy time; they are not a permanent substitute when a patch later ships.
Operational check: open an exception record with owner, residual risk, review date, and compensating controls; verify segmentation with a connectivity test; subscribe to vendor advisories; and apply the patch in the next change window with a validating rescan.