SSCP Risk Identification, Monitoring, and Analysis Practice Question
During a risk assessment, a company identifies that a legacy system cannot be patched due to vendor end-of-life. The system is critical to operations. Which risk response strategy is most appropriate initially?
⚠ Common exam trap
Candidates often confuse risk acceptance with passive inaction, but the SSCP exam expects that acceptance must be a deliberate decision with documented justification and often paired with compensating controls, not simply ignoring the risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mitigate the risk by implementing compensating controls
When a legacy system cannot be patched due to vendor end-of-life, the most appropriate initial risk response is to implement compensating controls. Compensating controls, such as network segmentation, strict access controls, or an intrusion detection system, reduce the likelihood or impact of exploitation without requiring a patch. This approach balances operational necessity with security, as immediate decommissioning (avoidance) may be infeasible for a critical system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Avoid the risk by decommissioning the system immediately
Why it's wrong here
Decommissioning may eliminate the risk but could disrupt critical business operations.
- ✗
Transfer the risk by purchasing cyber insurance
Why it's wrong here
Transfer is an option but typically not the first step; mitigation should be attempted first.
- ✗
Accept the risk without any further action
Why it's wrong here
Acceptance should be considered after mitigation attempts; doing nothing is not a default risk response.
- ✓
Mitigate the risk by implementing compensating controls
Why this is correct
Compensating controls such as network segmentation and strict access controls can reduce the risk even if the system cannot be patched.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.