CISA Protection of Information Assets Practice Question
An IS auditor is reviewing a vulnerability scan report and finds that a critical vulnerability on a web server has been open for 90 days beyond the remediation SLA. The system owner states that the vulnerability cannot be patched because it would break a legacy application. What should the auditor recommend?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require the system owner to sign a risk acceptance form
The appropriate action is to formally accept the risk through a documented risk acceptance process, with sign-off from management. This ensures accountability and awareness. The other options are either premature or inappropriate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Require the system owner to sign a risk acceptance form
Why this is correct
Formal risk acceptance documents the decision and accountability.
- ✗
Escalate the issue to the board of directors
Why it's wrong here
Escalation may be needed if risk acceptance is not obtained, but first recommend formal acceptance.
- ✗
Implement compensating controls and close the finding
Why it's wrong here
Compensating controls may reduce risk but the residual risk still needs acceptance.
- ✗
Recommend decommissioning the web server
Why it's wrong here
Decommissioning the web server would remove the vulnerability but also eliminate the legacy application the system owner explicitly states must remain operational. The scenario requires a compensating control—such as a web application firewall or network segmentation—that mitigates the risk without breaking the application. This option is tempting because decommissioning is a definitive remediation for an unpatched server, and it would be correct if the application were obsolete or had a replacement ready.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.