hardMultiple Choice
Risk Treatment for Unpatched Legacy Systems: Compensating Controls
During a risk assessment, the risk team identifies that a legacy system has multiple known vulnerabilities that cannot be patched. The system is critical for operations. Which of the following risk treatment options is MOST appropriate?
Quick Answer
The answer is to mitigate by implementing compensating controls. This is the most appropriate risk treatment for unpatched legacy systems because the vulnerabilities cannot be eliminated through patching, yet the system remains critical for operations, ruling out decommissioning or acceptance without action. Compensating controls—such as network segmentation, strict access controls, or an application-layer firewall—reduce the likelihood or impact of exploitation without modifying the vulnerable system itself, directly addressing the legacy system risk treatment challenge. On the CRISC exam, this scenario tests your ability to distinguish between risk treatment options when technical constraints and business criticality collide; a common trap is choosing “accept” because the system cannot be patched, but remember that compensating controls are a form of mitigation, not acceptance. Memory tip: “If you can’t patch it, segment and guard it.”
⚠ Common exam trap
Many exam-takers choose 'Accept the risk and monitor' (Option A) because they confuse 'acceptance' with a valid risk response for unpatched systems, failing to recognize that acceptance requires a formal decision and compensating controls when vulnerabilities are known and exploitable on critical assets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mitigate by implementing compensating controls
Since the legacy system cannot be patched (Option B is impossible) and is critical for operations (decommissioning would disrupt the business, making Option C too drastic), the most appropriate treatment is to implement compensating controls. These controls, such as network segmentation, strict access controls, or an application-layer firewall, reduce the likelihood or impact of exploitation without modifying the vulnerable system itself, aligning with the risk mitigation strategy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the risk and monitor
Why it's wrong here
Acceptance leaves multiple known vulnerabilities exposed on a critical system with no compensating controls, exceeding the organisation's tolerance. Acceptance suits low-impact risks or where treatment cost outweighs loss; this system's criticality demands mitigation or transfer.
- ✗
Remediate by applying patches from the vendor
Why it's wrong here
The stem states the vulnerabilities cannot be patched, so vendor remediation is unavailable. Patching is the default treatment for known vulnerabilities and would be correct where the vendor still issues supported fixes; here the constraint forces a different treatment.
- ✗
Avoid the risk by decommissioning the system
Why it's wrong here
Decommissioning removes the operational capability the business depends on, so it fails the stem's requirement that the system is critical for operations. It is tempting because risk avoidance genuinely eliminates the vulnerability exposure, and it would be correct where the system's function can be relocated or retired without disrupting critical operations.
- ✓
Mitigate by implementing compensating controls
Why this is correct
Compensating controls such as network segmentation, enhanced monitoring and strict access restrictions reduce the likelihood or impact of exploitation while the legacy system remains unpatched, matching the constraint that patching is impossible for a critical system.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a risk assessment, a risk practitioner identifies that a legacy application uses a deprecated encryption protocol. The application is critical for business operations and cannot be patched. Which of the following is the BEST approach to assess the risk?
medium- A.Replace the application with a modern alternative
- ✓ B.Analyze the threat landscape and existing compensating controls to determine residual risk
- C.Assign a high inherent risk score without further analysis
- D.Immediately escalate to senior management for an exception
Why B: The best approach to assess risk for a legacy application using a deprecated encryption protocol (e.g., SSL 3.0 or TLS 1.0) is to analyze the threat landscape and existing compensating controls. This allows the risk practitioner to determine the residual risk by considering factors such as whether the application is only accessible on an isolated network segment, whether network-level encryption (e.g., IPsec or a VPN tunnel) is in place, and whether the protocol is vulnerable to specific attacks like POODLE or BEAST. Simply assigning a high inherent risk score without further analysis (Option C) ignores compensating controls, while immediate escalation (Option D) or replacement (Option A) are risk treatment decisions, not risk assessment activities.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.