Certified Ethical Hacker (CEH) Practice Question

When an organization cannot immediately apply a vendor patch, patch-management guidance recommends a compensating control that blocks the attack vector until normal maintenance can occur. Deploying a virtual patch in a web application firewall (WAF) allows security teams to write rules that detect and drop the specific malicious request pattern used in CVE-2019-11043, closing the window of exposure without altering the production host. The other options do not remediate the underlying vulnerability: raising PHP's memory limit or enabling compression does nothing to stop the crafted request, and simply placing the server behind NAT keeps the service public while leaving it vulnerable.