Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Isaca Exam CISM Topic 2 Question 70 Discussion

Actual exam question for Isaca's Certified Information Security Manager exam
Question #: 70
Topic #: 2
[All Certified Information Security Manager Questions]

A business requires a legacy version of an application to operate but the application cannot be patched. To limit the risk exposure to the business, a firewall is implemented in front of the legacy application. Which risk treatment option has been applied?

Show Suggested Answer Hide Answer
Suggested Answer: A

Mitigate is the risk treatment option that has been applied by implementing a firewall in front of the legacy application because it helps to reduce the impact or probability of a risk. Mitigate is a process of taking actions to lessen the negative effects of a risk, such as implementing security controls, policies, or procedures. A firewall is a security device that monitors and filters the network traffic between the legacy application and the external network, blocking or allowing packets based on predefined rules. A firewall helps to mitigate the risk of unauthorized access, exploitation, or attack on the legacy application that cannot be patched. Therefore, mitigate is the correct answer.


https://simplicable.com/risk/risk-treatment

https://resources.infosecinstitute.com/topic/risk-treatment-options-planning-prevention/

https://www.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment.

by Xuan at Apr 10, 2024, 08:20 PM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Shonda
2 days ago
I'm with you on 'transfer' being the best answer. Putting a firewall in front of the legacy app is basically passing the risk on to the firewall, right? It's not really 'mitigating' the risk, it's just shifting it somewhere else.
upvoted 0 times
...
Ty
3 days ago
That's a good point. And if the legacy application can't be patched, then 'avoiding' the risk by not using the application is probably not an option. So 'mitigate' or 'transfer' seem like the most reasonable answers here.
upvoted 0 times
...
Elbert
4 days ago
Hmm, I'm not so sure. Couldn't you argue that the firewall is a way to 'mitigate' the risk by limiting the exposure? It's not a complete solution, but it's better than just accepting the risk, right?
upvoted 0 times
...
Socorro
6 days ago
I agree, the wording of the question is a bit confusing. Implementing a firewall doesn't really 'avoid' the risk either, since the legacy application is still running. I'm leaning towards 'transfer' as the best answer.
upvoted 0 times
...
Bernardine
7 days ago
This question seems tricky. I'm not sure if implementing a firewall in front of the legacy application is exactly 'mitigating' the risk. It feels more like we're trying to 'transfer' the risk to the firewall.
upvoted 0 times
...

Save Cancel