Isaca CISM Exam - Topic 2 Question 70 Discussion

Actual exam question for Isaca's CISM exam

Question #: 70
Topic #: 2

A business requires a legacy version of an application to operate but the application cannot be patched. To limit the risk exposure to the business, a firewall is implemented in front of the legacy application. Which risk treatment option has been applied?

AMitigate

BAccept

CTransfer

DAvoid

Show Suggested Answer

Suggested Answer: A

Mitigate is the risk treatment option that has been applied by implementing a firewall in front of the legacy application because it helps to reduce the impact or probability of a risk. Mitigate is a process of taking actions to lessen the negative effects of a risk, such as implementing security controls, policies, or procedures. A firewall is a security device that monitors and filters the network traffic between the legacy application and the external network, blocking or allowing packets based on predefined rules. A firewall helps to mitigate the risk of unauthorized access, exploitation, or attack on the legacy application that cannot be patched. Therefore, mitigate is the correct answer.

https://simplicable.com/risk/risk-treatment

https://resources.infosecinstitute.com/topic/risk-treatment-options-planning-prevention/

https://www.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment.

by Xuan at Apr 10, 2024, 08:20 PM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ria

7 months ago

Surprised they didn't just upgrade the application instead!

upvoted 0 times

...

Jamal

8 months ago

I thought they would just avoid using the old app altogether.

upvoted 0 times

...

Joaquin

8 months ago

Yeah, firewalls are a classic way to mitigate risks.

upvoted 0 times

...

Matthew

8 months ago

Not so sure about that, seems like a risky move.

upvoted 0 times

...

Micah

8 months ago

Definitely a mitigate option!

upvoted 0 times

...

Markus

9 months ago

I feel like avoiding the risk would mean not using the application at all, so it must be mitigating it with the firewall.

upvoted 0 times

...

Chery

9 months ago

This reminds me of a practice question where we discussed transferring risk through insurance, but that doesn't seem to fit here.

upvoted 0 times

...

Dana

9 months ago

I'm not entirely sure, but I remember something about accepting risks when you can't change the system.

upvoted 0 times

...

Sylvie

9 months ago

I think this is about risk mitigation since the firewall is meant to reduce the risk from the legacy app.

upvoted 0 times

...

Layla

9 months ago

I'm a little confused by the wording here. Is Mitigate the right answer since they're implementing a control (the firewall) to reduce the risk? Or is it Accept since they're just managing the risk rather than trying to eliminate it? I'll have to think about this one a bit more.

upvoted 0 times

...

Gennie

9 months ago

Okay, let me think this through. The business is using a firewall to limit the risk, which sounds like a risk treatment option. Since they're not transferring the risk or avoiding it, I think the answer is Mitigate.

upvoted 0 times

...

Charlene

9 months ago

Hmm, I'm a bit unsure about this one. The question mentions a legacy application that can't be patched, so I'm not sure if Mitigate is the right answer. Maybe it's Accept since they're just managing the risk instead of trying to eliminate it?

upvoted 0 times

...

Delfina

9 months ago

This seems like a straightforward risk management question. I think the answer is Mitigate, since the business is implementing a firewall to limit the risk exposure from the legacy application.

upvoted 0 times

...

Cheryl

9 months ago

Ah, I think I've seen this kind of issue before. It's probably an SSO authentication error.

upvoted 0 times

...

Jerry

9 months ago

I'm pretty confident the answer is C. Quinolones are the class of antibiotics that should not be taken with fruit juices or colas. I remember the professor emphasizing that in our last lecture.

upvoted 0 times

...

Chandra

10 months ago

I'm confident the software from my former employer is the superior option, so I'll just go ahead and purchase it. No need to overcomplicate things.

upvoted 0 times

...

Tasia

2 years ago

I still think it's more about mitigating the risk because the firewall is actively reducing the impact of potential threats.

upvoted 0 times

...

Richelle

2 years ago

That's a good point. It could be seen as both risk mitigation and risk transfer, depending on how you look at it.

upvoted 0 times

...

Mira

2 years ago

But couldn't this also fall under risk transfer by shifting the risk to the firewall?

upvoted 0 times

...

Tasia

2 years ago

I agree with Richelle. Implementing a firewall to protect the legacy application is a form of risk mitigation.

upvoted 0 times

...

Richelle

2 years ago

I think the risk treatment option applied in this case is to mitigate the risk.

upvoted 0 times

...

Tonja

2 years ago

I think the correct answer would be transferring the risk. They are not fully mitigating it, just shifting it to another component.

upvoted 0 times

...

Cheryll

2 years ago

I believe it's more of a risk transfer. The firewall is now handling the risk instead of the legacy application.

upvoted 0 times

...

Fernanda

2 years ago

But wouldn't that be transferring the risk to the firewall instead of fully mitigating it?

upvoted 0 times

...

Naomi

2 years ago

I agree with By implementing a firewall, they are trying to reduce the risk.

upvoted 0 times

...

Olen

2 years ago

I think the risk treatment option applied is to mitigate.

upvoted 0 times

...

Jenise

2 years ago

Hey, you know what they say - 'if you can't beat the firewall, join the firewall!' Am I right, guys? *laughs*

upvoted 0 times

...

Shonda

2 years ago

I'm with you on 'transfer' being the best answer. Putting a firewall in front of the legacy app is basically passing the risk on to the firewall, right? It's not really 'mitigating' the risk, it's just shifting it somewhere else.

upvoted 0 times

...

Ty

2 years ago

That's a good point. And if the legacy application can't be patched, then 'avoiding' the risk by not using the application is probably not an option. So 'mitigate' or 'transfer' seem like the most reasonable answers here.

upvoted 0 times

Tish

2 years ago

I agree. So, it must be either mitigate or transfer.

upvoted 0 times

...

Peter

2 years ago

True, avoiding the risk is not an option.

upvoted 0 times

...

Elbert

2 years ago

Hmm, I'm not so sure. Couldn't you argue that the firewall is a way to 'mitigate' the risk by limiting the exposure? It's not a complete solution, but it's better than just accepting the risk, right?

upvoted 0 times

Genevive

2 years ago

Exactly, the firewall is a form of risk transfer by placing a protective layer in front of the legacy application.

upvoted 0 times

...

Judy

2 years ago

C) Transfer

upvoted 0 times

...

Chaya

2 years ago

I think it's more of a 'transfer' because the firewall is shifting the risk to the barrier instead of accepting it.

upvoted 0 times

...

Diego

2 years ago

B) Accept

upvoted 0 times

...

Della

2 years ago

No, the firewall is actually a way to 'transfer' the risk by placing a barrier in front of the application.

upvoted 0 times

...

Sage

2 years ago

A) Mitigate

upvoted 0 times

...

Socorro

2 years ago

I agree, the wording of the question is a bit confusing. Implementing a firewall doesn't really 'avoid' the risk either, since the legacy application is still running. I'm leaning towards 'transfer' as the best answer.

upvoted 0 times

...

Bernardine

2 years ago

This question seems tricky. I'm not sure if implementing a firewall in front of the legacy application is exactly 'mitigating' the risk. It feels more like we're trying to 'transfer' the risk to the firewall.

upvoted 0 times

...