Risk Mitigation Strategy Example: Compensating Controls for Legacy Systems
After completing a vulnerability scan, a security analyst discovers that a legacy customer-facing application running on an unsupported operating system contains a critical remote code execution vulnerability. The application is essential to daily operations and cannot be patched or upgraded in the near term. Management has approved the purchase of a hardware-based network firewall that will be placed in front of the application to restrict inbound traffic to only authorized source IP addresses and port numbers. Which risk management strategy does this action primarily represent?
Quick Answer
The answer is risk mitigation. This is correct because deploying a hardware firewall to restrict inbound traffic directly reduces the likelihood of exploitation by limiting the attack surface, which is the core of risk mitigation—applying controls to lower risk to an acceptable level when patching or upgrading is not feasible. In this scenario, the compensating controls (firewall, ACLs, network segmentation) serve as a practical risk mitigation strategy example for legacy systems, a common Security+ SY0-701 exam trap where candidates confuse mitigation with risk acceptance or transference. The exam tests your ability to distinguish between risk response types: mitigation actively reduces vulnerability exposure, while acceptance would mean doing nothing and transference would involve insurance or outsourcing. Remember the mnemonic “M.A.T.”—Mitigation Acts on Threats, while Acceptance and Transference do not directly reduce the attack surface.
⚠ Common exam trap
Watch out — candidates often confuse 'risk mitigation' with 'risk avoidance' because they think blocking traffic is 'avoiding' the vulnerability, but avoidance means eliminating the risk entirely (e.g., decommissioning the app), whereas mitigation reduces the likelihood or impact while the risk still exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk mitigation
The security team is implementing a hardware-based network firewall to restrict inbound traffic to only authorized source IP addresses and port numbers. This directly reduces the likelihood of exploitation by limiting the attack surface, which is the essence of risk mitigation — applying controls to reduce the risk to an acceptable level. Patching or upgrading is not feasible, so compensating controls like network segmentation and access control lists (ACLs) are used to mitigate the vulnerability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Risk acceptance
Why it's wrong here
Risk acceptance would mean acknowledging the vulnerability and choosing to take no action to reduce it. The organization is actively implementing a control, which goes beyond acceptance.
When this WOULD be correct
Risk acceptance would be correct if the organization decided to continue operating the vulnerable application without implementing any controls, formally acknowledging the risk and its potential impact without taking further action.
- ✓
Risk mitigation
Why this is correct
Correct. By deploying a firewall to restrict access, the organization is reducing the likelihood that the vulnerability can be exploited. This is a risk mitigation strategy using a compensating control.
- ✗
Risk avoidance
Why it's wrong here
Risk avoidance would involve eliminating the vulnerability entirely, for example by shutting down the application or replacing it. The organization is keeping the application running and protecting it with a firewall, which is not avoidance.
When this WOULD be correct
Risk avoidance would be correct if the organization decided to decommission the legacy application or replace it with a different system that does not have the vulnerability, thereby eliminating the risk entirely.
- ✗
Risk transference
Why it's wrong here
Risk transference shifts the financial burden of a potential loss to a third party, such as purchasing cyber insurance. The organization is not transferring the risk; it is implementing a technical control.
When this WOULD be correct
A company identifies a high-risk vulnerability in a legacy system and decides to purchase a cybersecurity insurance policy to cover potential financial losses from exploitation, rather than implementing technical controls. This would be risk transference.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Risk mitigationCorrect answer▾
Why this is correct
Correct. By deploying a firewall to restrict access, the organization is reducing the likelihood that the vulnerability can be exploited. This is a risk mitigation strategy using a compensating control.
✗Risk acceptanceWrong answer — click to see why▾
Why this is wrong here
Risk acceptance involves acknowledging a risk and taking no action to reduce it, but here management approved purchasing and deploying a firewall to restrict traffic, which actively reduces the vulnerability's exploitability.
★ When this WOULD be the correct answer
Risk acceptance would be correct if the organization decided to continue operating the vulnerable application without implementing any controls, formally acknowledging the risk and its potential impact without taking further action.
Why candidates choose this
Candidates may confuse acceptance with the decision to keep the application running despite the vulnerability, overlooking that the firewall deployment is a proactive control that reduces risk.
✗Risk avoidanceWrong answer — click to see why▾
Why this is wrong here
Risk avoidance would mean eliminating the risk by discontinuing the application or removing the vulnerability entirely, but the question states the application cannot be patched or upgraded and remains in use, so the risk is not avoided.
★ When this WOULD be the correct answer
Risk avoidance would be correct if the organization decided to decommission the legacy application or replace it with a different system that does not have the vulnerability, thereby eliminating the risk entirely.
Why candidates choose this
Candidates may confuse 'avoidance' with 'prevention' and think that adding a firewall avoids the risk, but avoidance requires ceasing the risky activity, not just reducing the likelihood of exploitation.
✗Risk transferenceWrong answer — click to see why▾
Why this is wrong here
Risk transference involves shifting the financial impact of a risk to a third party (e.g., purchasing cyber insurance or outsourcing). In this scenario, the organization is directly implementing a firewall to reduce the vulnerability's exploitability, which is a mitigation action, not transferring the risk.
★ When this WOULD be the correct answer
A company identifies a high-risk vulnerability in a legacy system and decides to purchase a cybersecurity insurance policy to cover potential financial losses from exploitation, rather than implementing technical controls. This would be risk transference.
Why candidates choose this
Candidates may confuse purchasing a hardware firewall with transferring risk to a vendor, but the firewall is a technical control retained by the organization, not a transfer of financial liability.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Risk mitigation
Risk mitigation is the process of reducing the likelihood or impact of a potential security threat to an acceptable level through specific controls and actions.
Key term
Risk management
Risk management is the process of identifying, assessing, and controlling threats to an organization's capital, earnings, and operations, including IT systems and data.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has two security issues to address this week. One is a public-facing login portal that uses default administrator credentials. The other is an internal lab system used only by one tester. Which issue should be prioritized first?
easy- A.The internal lab system, because it is easier to fix quickly
- ✓ B.The public-facing login portal, because it has a higher likelihood and impact
- C.Both issues have the same priority because they are both vulnerabilities
- D.Neither issue should be addressed until the next annual review
Why B: The public-facing login portal with default administrator credentials is a critical risk because it is exposed to the internet, making it easily discoverable and exploitable by attackers. Default credentials are widely known and often targeted in automated attacks, leading to a high likelihood of compromise and potential impact such as data breach or system takeover. This aligns with risk management principles where priority is given to vulnerabilities with the highest risk score (likelihood × impact).
Variation 2. After implementing MFA and stronger monitoring, a department still has a small chance of account misuse that could affect a low-value internal tool. The business owner reviews the remaining exposure and agrees it is within tolerance. What should happen next?
medium- A.Escalate the issue to legal because all residual risk must be eliminated.
- ✓ B.Document the residual risk and obtain formal acceptance from the risk owner.
- C.Remove MFA because the remaining risk is already low.
- D.Treat the issue as resolved because monitoring alone eliminates all risk.
Why B: After implementing MFA and stronger monitoring, the remaining exposure is residual risk that must be formally documented and accepted by the risk owner (the business owner). This aligns with the risk management process in Security Program Management, where residual risk that falls within the organization's risk appetite is accepted rather than eliminated. The business owner's agreement indicates formal acceptance, which should be recorded for audit and compliance purposes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.