Handling Zero-Day Vulnerabilities Without Patches

The scenario presents a critical security gap: a zero-day vulnerability with no vendor patch, accompanied by public indicators of compromise (IoCs). The question asks for the appropriate technique to employ until a fix is available.

C. Continuous monitoring is the correct answer. In the absence of a remediation patch, the primary defensive strategy shifts to detection and response. By continuously monitoring systems against the published IoCs, security teams can identify active exploitation attempts in real-time, allowing them to contain threats and mitigate impact despite the underlying vulnerability remaining unpatched. This aligns with CompTIA Security+ objectives regarding incident response and threat hunting when traditional mitigation (patching) is unavailable.

A. Sinkholing is incorrect because it is a specific network-level tactic used primarily to neutralize command-and-control (C2) traffic associated with botnets or malware domains. While useful in certain infection scenarios, it does not address the broader scope of exploiting a zero-day application vulnerability across potentially many hosts, nor does it serve as a general compensating control for the vulnerability itself.

B. Eradication techniques are incorrect because eradication is a phase within the incident response lifecycle that occurs after an incident has been contained and the root cause eliminated. It is not a proactive measure taken while a system remains vulnerable and potentially active.

D. Evidence acquisition is incorrect because this is part of the forensics and preservation process, typically performed after an incident is detected or during a legal investigation. It is not a defensive technique to protect the system from ongoing exploitation.

Community comments suggest confusion between sinkholing and monitoring, but sinkholing is too narrow and situational for a general zero-day application exploit without specified C2 infrastructure.