Question

A CySA+ analyst is drafting the recommendations section of a vulnerability report for a critical flaw in an internet-facing application. The vendor has not yet released a patch, but the analyst identified a way to reduce exposure by disabling a vulnerable module and adding a WAF rule. What is the MOST accurate way to characterize these proposed actions in the report to the stakeholders?

Accepted Answer

Describe them as mitigation measures that reduce risk while a permanent remediation (vendor patch) remains pending

Answer

Describe them as remediation that fully eliminates the vulnerability and closes the finding

Answer

Describe them as a risk acceptance since no patch is available yet

Answer

Describe them as a false positive because the vulnerable code path is now unreachable