mediumMultiple ChoiceObjective-mapped
Unpatched Legacy System Risk Treatment for CASP+
A security analyst is reviewing the results of a vulnerability scan and identifies a critical vulnerability in a legacy application that cannot be patched because it is no longer supported by the vendor. The application is critical for business operations. Which of the following risk treatment strategies should the organization implement?
Quick Answer
The answer is risk acceptance with compensating controls such as network segmentation and strict access controls. This is correct because when a legacy unpatched system is critical to operations but cannot be patched due to vendor end-of-life, the residual risk must be formally accepted while deploying compensating controls to reduce the attack surface. Network segmentation, using VLANs and ACLs, contains potential exploitation, and strict access controls like least privilege and MFA limit exposure, aligning with the NIST SP 800-37 risk management framework. On the CompTIA SecurityX CAS-004 exam, this scenario tests your ability to distinguish risk treatment strategies—specifically that acceptance does not mean ignoring risk but rather acknowledging it with active mitigations. A common trap is choosing risk mitigation (patching) or avoidance (removing the system), which are impossible here. Memory tip: “ACCEPT with COMPENSATION” — you accept the vulnerability but compensate with layers of defense.
⚠ Common exam trap
Test-takers frequently confuse risk acceptance with doing nothing, but in CAS-004, risk acceptance requires documented compensating controls to reduce residual risk to an acceptable level, not simply ignoring the vulnerability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk acceptance with compensating controls such as network segmentation and strict access controls.
When a legacy application cannot be patched due to vendor end-of-life, the organization must accept the residual risk while implementing compensating controls. Network segmentation (e.g., VLANs, ACLs) and strict access controls (e.g., least privilege, MFA) reduce the attack surface and contain potential exploitation, aligning with the risk acceptance strategy under the NIST SP 800-37 risk management framework.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk transfer by purchasing cyber insurance to cover potential losses.
Why it's wrong here
Insurance does not treat the vulnerability; it only provides financial recovery.
- ✗
Risk mitigation by applying a vendor-supplied patch.
Why it's wrong here
No patch is available as the vendor no longer supports the application.
- ✗
Risk avoidance by decommissioning the application and migrating to a new system.
Why it's wrong here
Avoidance would eliminate the risk but is not feasible due to business criticality.
- ✓
Risk acceptance with compensating controls such as network segmentation and strict access controls.
Why this is correct
Acceptance acknowledges the residual risk, and compensating controls reduce likelihood/impact.
Visual reference
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CAS-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a risk assessment, the analyst identifies that a legacy system containing sensitive data cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk treatment strategy is MOST appropriate?
medium- A.Transfer by purchasing cyber insurance
- B.Avoidance by decommissioning the system
- C.Acceptance by documenting the risk
- ✓ D.Mitigation by implementing compensating controls
Why D: When a legacy system cannot be patched due to vendor end-of-life, the most appropriate risk treatment is to implement compensating controls (e.g., network segmentation, strict access controls, host-based intrusion detection) to reduce the likelihood or impact of exploitation. This allows the organization to continue critical operations while managing the residual risk, as avoidance or transfer would be impractical or insufficient.
Variation 2. A security analyst at a large enterprise notices that several servers have missing security patches that are critical. The patch management process requires approval from the change advisory board (CAB) which meets weekly. The next meeting is in three days, but the vulnerability is being actively exploited. What should the analyst do?
medium- ✓ A.Implement temporary compensating controls until the CAB approves.
- B.Apply the patches immediately without waiting for CAB approval.
- C.Notify the system owners and leave the decision to them.
- D.Document the issue and wait for the CAB meeting.
Why A: When a critical vulnerability is being actively exploited, the security analyst must prioritize risk mitigation over standard change management processes. Implementing temporary compensating controls (e.g., network segmentation, host-based firewall rules, or disabling the vulnerable service) reduces the attack surface immediately while still seeking formal CAB approval for the permanent patch. This balances the need for rapid response with the enterprise's governance requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.