hardMultiple ChoiceObjective-mapped
Best Compensating Controls for Unpatched Legacy Systems
Your organization is a medium-sized e-commerce company with a hybrid infrastructure: on-premises datacenter and AWS cloud. The security team recently conducted an internal vulnerability scan of the on-premises network and discovered multiple critical vulnerabilities in a legacy ERP system that cannot be patched because the vendor no longer supports it. The ERP system is essential for order processing and cannot be decommissioned. The team also ran a penetration test against the cloud environment and found that an attacker with network access could leverage misconfigured security groups to move laterally between instances. The company has a risk appetite that allows for limited risk acceptance with compensating controls. As the senior security analyst, what is the BEST course of action?
Quick Answer
The answer is to apply virtual patching via an intrusion prevention system for the ERP vulnerabilities and implement stricter security group rules in the cloud to restrict lateral movement. This is the best course of action because it provides compensating controls for unpatched legacy systems, using virtual patching to shield the critical vulnerabilities without altering the unsupported software, while segmentation via tightened security groups directly addresses the lateral movement risk found in the cloud environment. On the CISSP exam, this scenario tests your understanding of risk management and the application of compensating controls when patching is impossible; a common trap is choosing to decommission the system or accept all risk outright, which violates the risk appetite that allows for limited acceptance with controls. Remember the mnemonic “VIPS” for Virtual patching, IPS, and Segmentation to recall the core compensating controls for unpatched legacy systems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply virtual patching via an intrusion prevention system (IPS) for the ERP vulnerabilities and implement stricter security group rules in the cloud to restrict lateral movement.
The best course of action because it applies compensating controls to reduce risk without disrupting operations. Virtual patching via an IPS mitigates the unpatched ERP vulnerabilities, while stricter security group rules limit lateral movement in the cloud. This aligns with the organization's risk appetite for limited risk acceptance with compensating controls. Option A is too disruptive, Option B would cause unacceptable operational disruption, and Option C fails to implement any controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately isolate the legacy ERP system from the network and implement a manual workaround for order processing.
Why it's wrong here
Isolation may cause significant operational disruption, and manual workarounds are error-prone.
- ✗
Decommission the legacy ERP system and migrate to a modern alternative, accepting a temporary disruption in operations.
Why it's wrong here
Migration is a long-term solution; immediate disruption is not warranted and may be unacceptable to the business.
- ✗
Accept the risk for both findings and document them in the risk register without additional controls.
Why it's wrong here
The risk appetite allows limited acceptance, but these critical vulnerabilities warrant compensating controls.
- ✓
Apply virtual patching via an intrusion prevention system (IPS) for the ERP vulnerabilities and implement stricter security group rules in the cloud to restrict lateral movement.
Why this is correct
Virtual patching and network segmentation provide effective compensating controls that reduce risk while maintaining operations.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Risk appetite
Risk appetite is the amount of risk an organization is willing to accept in pursuit of its objectives, defining the boundaries for decision-making.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company's vulnerability management program requires that all critical vulnerabilities be remediated within 30 days. A critical vulnerability is discovered in a legacy system that cannot be patched because the vendor no longer supports it. Which of the following is the best compensating control?
hard- A.Deploy a host-based intrusion detection system (HIDS)
- B.Increase logging and monitoring
- ✓ C.Segment the system from the rest of the network
- D.Encrypt all data at rest on the system
Why C: Network segmentation isolates the legacy system, reducing the attack surface. HIDS only detects, not prevents. Logging and monitoring are detective controls. Encryption does not prevent exploitation of the vulnerability.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.