hardMultiple ChoiceObjective-mapped
Risk Treatment for Unpatched Legacy Systems: Compensating Controls
During a risk assessment, the risk team identifies that a legacy system has multiple known vulnerabilities that cannot be patched. The system is critical for operations. Which of the following risk treatment options is MOST appropriate?
Quick Answer
The answer is to mitigate by implementing compensating controls. This is the most appropriate risk treatment for unpatched legacy systems because the vulnerabilities cannot be eliminated through patching, yet the system remains critical for operations, ruling out decommissioning or acceptance without action. Compensating controls—such as network segmentation, strict access controls, or an application-layer firewall—reduce the likelihood or impact of exploitation without modifying the vulnerable system itself, directly addressing the legacy system risk treatment challenge. On the CRISC exam, this scenario tests your ability to distinguish between risk treatment options when technical constraints and business criticality collide; a common trap is choosing “accept” because the system cannot be patched, but remember that compensating controls are a form of mitigation, not acceptance. Memory tip: “If you can’t patch it, segment and guard it.”
⚠ Common exam trap
Many exam-takers choose 'Accept the risk and monitor' (Option A) because they confuse 'acceptance' with a valid risk response for unpatched systems, failing to recognize that acceptance requires a formal decision and compensating controls when vulnerabilities are known and exploitable on critical assets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mitigate by implementing compensating controls
Since the legacy system cannot be patched (Option B is impossible) and is critical for operations (decommissioning would disrupt the business, making Option C too drastic), the most appropriate treatment is to implement compensating controls. These controls, such as network segmentation, strict access controls, or an application-layer firewall, reduce the likelihood or impact of exploitation without modifying the vulnerable system itself, aligning with the risk mitigation strategy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the risk and monitor
Why it's wrong here
May be insufficient if risk exceeds appetite.
- ✗
Remediate by applying patches from the vendor
Why it's wrong here
Patching is not possible as vulnerabilities cannot be patched.
- ✗
Avoid the risk by decommissioning the system
Why it's wrong here
May not be feasible for critical operations.
- ✓
Mitigate by implementing compensating controls
Why this is correct
Reduces risk while preserving system functionality.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a risk assessment, a risk practitioner identifies that a legacy application uses a deprecated encryption protocol. The application is critical for business operations and cannot be patched. Which of the following is the BEST approach to assess the risk?
medium- A.Replace the application with a modern alternative
- ✓ B.Analyze the threat landscape and existing compensating controls to determine residual risk
- C.Assign a high inherent risk score without further analysis
- D.Immediately escalate to senior management for an exception
Why B: The best approach to assess risk for a legacy application using a deprecated encryption protocol (e.g., SSL 3.0 or TLS 1.0) is to analyze the threat landscape and existing compensating controls. This allows the risk practitioner to determine the residual risk by considering factors such as whether the application is only accessible on an isolated network segment, whether network-level encryption (e.g., IPsec or a VPN tunnel) is in place, and whether the protocol is vulnerable to specific attacks like POODLE or BEAST. Simply assigning a high inherent risk score without further analysis (Option C) ignores compensating controls, while immediate escalation (Option D) or replacement (Option A) are risk treatment decisions, not risk assessment activities.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.