Which of the following best describes the range of mitigations you might recommend?

• A. Increasing monitoring only
• B. Applying patches, Hardening systems, Applying a filter, Altering architecture, Changing process
• C. Replacing entire network
• D. Ignoring vulnerabilities

Answer: (B)

A good set of mitigations uses layered protection that covers people, process, and technology. Patching closes known vulnerabilities at the source, reducing the chance an attacker can exploit a flaw. System hardening tightens configurations, disables unused services, and removes unnecessary components to shrink the attack surface. Filtering solutions like firewalls, intrusion detection and prevention systems, and web application firewalls help block or slow attacker attempts at the network and application layers. Altering architecture—such as network segmentation, stricter access controls, and isolation of sensitive components—limits how far an attacker can move if a breach occurs. Changing processes, including secure development practices, regular patch management, and change control, keeps defenses effective over time. Together, these measures form multiple, complementary controls that reduce risk more effectively than any single action.

Relying solely on monitoring provides visibility but not prevention, replacing an entire network is impractical and misses targeted vulnerability remediation, and ignoring vulnerabilities leaves systems open to known flaws.