mediumMultiple Choice
CS0-003 Practice Question: A legacy system cannot be patched because the…
A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For control selection, Which control best addresses the stated weakness without hiding risk?
⚠ Common exam trap
The CS0-004 exam often tests the misconception that removing a system from reports or marking it as fixed is an acceptable shortcut, when in fact the correct process requires formal risk acceptance with compensating controls and a documented plan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Documented risk acceptance with compensating controls and a migration/remediation plan
When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally document the risk acceptance, implement compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and create a migration or remediation plan to eventually retire or replace the system. This approach transparently acknowledges the residual risk rather than hiding it, aligning with the principle of risk treatment as defined in NIST SP 800-53 and ISO 27005.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mark the vulnerability as fixed
Why it's wrong here
Marking the vulnerability as fixed falsifies the record; the flaw remains exploitable because no patch or compensating control was applied. It is tempting because the finding disappears from dashboards and metrics, which suits confirmed false positives after validation, not genuine unpatchable vulnerabilities requiring documented risk acceptance.
- ✓
Documented risk acceptance with compensating controls and a migration/remediation plan
Why this is correct
Because the vendor no longer supports the application, patching is impossible, so the residual risk must be formally owned. Documented risk acceptance records that decision, compensating controls reduce likelihood or impact, and the migration plan provides a route off the unsupported system.
- ✗
Remove the system from future reports
Why it's wrong here
Removing the system from reports conceals the residual risk instead of reducing it, leaving the unpatchable weakness unmanaged and unaudited. It is tempting because report noise drops and dashboards look clean, which suits genuinely decommissioned or duplicate assets, not live legacy systems still processing business transactions.
- ✗
Give all users local admin rights
Why it's wrong here
Granting local admin rights widens the attack surface and permits arbitrary code execution, privilege escalation and malware persistence on the unpatchable host. It is tempting because administrators gain freedom to install compensating agents and workarounds, which suits tightly controlled standalone lab machines, not production systems holding sensitive data.
Go deeper
Related to this question
Learn chapter
Identity-Based Attack Patterns: Pass-the-Hash, Kerberoasting
Key term
Risk treatment
Risk treatment is the process of selecting and implementing measures to modify risk, which can include avoiding, accepting, mitigating, or transferring the risk.
Key term
Remediation
Remediation is the process of fixing or eliminating vulnerabilities, misconfigurations, or security weaknesses in an IT environment.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.