Protecting Unsupported Application Servers
Answer
Correct answer: D — Deploying the application server in a screened subnet isolates it from direct exposure while allowing controlled communication through firewalls.
Which of the following is the most effective way to protect an application server running software that is no longer supported from network threats?
Community Votes
72% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the balance between security isolation and operational utility; the trap is choosing air gapping, which renders the server useless despite being technically secure.
This question addresses the most effective network protection method for an application server running unsupported software. The correct approach involves isolating the server in a screened subnet to mitigate risks while maintaining necessary functionality.
Many candidates choose Air Gap because it offers the highest level of physical security, failing to recognize that an application server must remain accessible to function as intended.
Community Discussion (18 comments)
johnabayot
👍 17
Selected: D
One of the most effective ways to protect an application server is to use a screened subnet. A screened subnet is a network segment that is isolated from both the internet and the internal network by two firewalls. The application server is placed in the screened subnet, also known as the demilitarized zone (DMZ), and only the necessary ports are opened for communication. This way, the application server is shielded from external attacks and internal breaches, and the impact of a compromise is minimized.
1403ad2
👍 11
Selected: D
choose D 2024-20-2 On Test and passed with 802
Honeybadge
👍 1
Selected: D
An air gap involves completely isolating the server from any network. While this provides strong security, it's not practical for an application server that needs to interact with other systems or users.
spencer0328
👍 3
Selected: A
The most effective way to protect an application server with unsupported software is to use an air gap. An air gap physically isolates the server from all network connections, eliminating the possibility of network-based attacks. This level of isolation is crucial for unsupported software, which is particularly vulnerable to exploits due to the lack of security updates. In contrast, a screened subnet would still expose the server to some degree of risk because it allows controlled external access. While it mitigates some threats by isolating the server from the internal network, it does not provide the complete isolation that an air gap does .
LayinCable
👍 3
Selected: A
Its Air Gapping. They use this same technique on factory robotics, that way they cannot be overran and malfunction due to a malicious attacker BECAUSE they are literally cut off from the rest of the network AND the internet. They have no outward facing components.
AspiringNerd
👍 2
Selected: D
Screened subnet..AKA demilitarized zone (DMZ).
_deleteme_
👍 2
A - Air Gapping is isolating a system physically by disconnecting it from all networks. Physical separation is one of the most secure methods of security, but still vulnerable from sophisticated attack.
Imjusthere00
👍 4
Selected: A
I believe it’s Air Gap
slapster
👍 3
Selected: D
I like answer choice D here -- screened subnet. An air gap would remove the server from the network completely, and would certainly be employed in an incident response where isolation-based containment is needed. If they are still needing to use the application server, however, and simply employ compensating controls, a screened subnet is better. CompTIA Section 9A: "A screened subnet uses two firewalls placed on either side of the DMZ. The edge firewall restricts traffic on the external/public interface and allows permitted traffic to the hosts in the DMZ. The edge firewall can be referred to as the screening firewall or router. The internal firewall filters communications between hosts in the DMZ and hosts on the LAN. This firewall is often described as the choke firewall. A choke point is a purposefully narrow gateway that facilitates better access control and easier monitoring."
TM78
👍 5
Selected: D
D. Screened subnet ~ It’s an application server. Why would anyone air gap an application server? That would make it useless.
kewokil120
👍 2
Selected: D
One of the most effective ways to protect an application server is to use a screened subnet. A screened subnet is a network segment that is isolated from both the internet and the internal network by two firewalls. The application server is placed in the screened subnet, also known as the demilitarized zone (DMZ), and only the necessary ports are opened for communication. This way, the application server is shielded from external attacks and internal breaches, and the impact of a compromise is minimized.
Payu1994
👍 2
A. Air gap Explanation: Air gap (Option A): An air gap involves physically isolating a system or network from external networks, ensuring that there is no direct connection. This isolation significantly reduces the risk of network threats, as there are no pathways for malicious actors to exploit vulnerabilities remotely. It is particularly effective for systems running unsupported software because it provides a strong barrier against external attacks.
caseymd85
👍 1
Selected: A
A. air gap A screened subnet is still accessible.
dfc6822
👍 1
A. Air gap The most effective way to protect an application server running software that is no longer supported from network threats is to use an air gap.
ganymede
👍 1
Selected: A
A. Air gap
Jay987654
👍 2
Selected: A
The most effective way to protect an application server running unsupported software from network threats is A. Air gap. An air gap is a security measure that physically isolates a computer or network from other systems and networks, including the internet. This means that there is no direct connection between the air-gapped system and any other system, making it impossible for network-based threats to reach the isolated system.
Hs1208
👍 1
Selected: D
D. Screened subnet
LuckyAro
👍 2
Selected: A
"Air gap," is the most effective way to protect an application server running unsupported software from network threats. Air gapping involves physically isolating the server from any external networks, making it inaccessible from the internet or other connected systems.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A screened subnet (DMZ) is the most effective solution here because it provides network-level isolation using firewalls without disconnecting the server from the network entirely. Since the server runs unsupported software, it is vulnerable to exploits, but placing it in a screened subnet allows administrators to restrict traffic strictly to what is necessary for the application. This compensating control reduces the attack surface significantly compared to placing it on the internal network or exposing it directly to the internet.Why the Other Options Are Wrong
Air gap (Option A) physically disconnects the server from all networks, which would make an 'application server' useless as applications require connectivity to serve users or other systems. Barricade (Option B) is not a standard cybersecurity term or architectural component. Port security (Option C) typically refers to switch-level access control (like MAC address filtering) and does not provide sufficient perimeter defense against network threats targeting unpatched vulnerabilities.Community Comment Notes
Community consensus strongly favors Option D, with many users noting that air-gapping an active application server contradicts its purpose. One user pointed out that a screened subnet uses two firewalls to isolate the segment, which is ideal for vulnerable systems. Another comment highlighted that air gaps are used for incident response containment, whereas a screened subnet is a proactive architectural choice for ongoing operations.Official Reference
Exam Strategy
When a question specifies a device type like 'application server' or 'database server,' assume it must remain connected to the network to perform its function. Therefore, options that imply total disconnection (like Air Gap) are usually incorrect unless the scenario explicitly states the system is offline or decommissioned.
Frequently Asked Questions
Why isn't Air Gap the best answer for unsupported software?
Air gapping physically disconnects the device, making an 'application server' unable to serve any requests. It is too extreme for a system that needs to operate.
What is a screened subnet in CompTIA Security+ context?
It is a DMZ (Demilitarized Zone) isolated by one or more firewalls, used to host public-facing services so they don't expose the internal network if compromised.