MENU
A business requires a legacy version of an application to operate but the application cannot be patched. To limit the risk exposure to the business, a firewall is implemented in front of the legacy application. Which risk treatment option has been applied?
Suggested Answer: A
Get Premium CISM Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Mitigate is the risk treatment option that has been applied by implementing a firewall in front of the legacy application because it helps to reduce the impact or probability of a risk. Mitigate is a process of taking actions to lessen the negative effects of a risk, such as implementing security controls, policies, or procedures. A firewall is a security device that monitors and filters the network traffic between the legacy application and the external network, blocking or allowing packets based on predefined rules. A firewall helps to mitigate the risk of unauthorized access, exploitation, or attack on the legacy application that cannot be patched. Therefore, mitigate is the correct answer.
https://simplicable.com/risk/risk-treatment
https://resources.infosecinstitute.com/topic/risk-treatment-options-planning-prevention/
https://www.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment.
40 comments · newest first
RI
Ria
10 months ago
Surprised they didn't just upgrade the application instead!
JA
Jamal
11 months ago
I thought they would just avoid using the old app altogether.
JO
Joaquin
11 months ago
Yeah, firewalls are a classic way to mitigate risks.
MA
Matthew
11 months ago
Not so sure about that, seems like a risky move.
MI
Micah
11 months ago
Definitely a mitigate option!
MA
Markus
12 months ago
I feel like avoiding the risk would mean not using the application at all, so it must be mitigating it with the firewall.
CH
Chery
12 months ago
This reminds me of a practice question where we discussed transferring risk through insurance, but that doesn't seem to fit here.
DA
Dana
12 months ago
I'm not entirely sure, but I remember something about accepting risks when you can't change the system.
SY
Sylvie
1 year ago
I think this is about risk mitigation since the firewall is meant to reduce the risk from the legacy app.
LA
Layla
1 year ago
I'm a little confused by the wording here. Is Mitigate the right answer since they're implementing a control (the firewall) to reduce the risk? Or is it Accept since they're just managing the risk rather than trying to eliminate it? I'll have to think about this one a bit more.
GE
Gennie
1 year ago
Okay, let me think this through. The business is using a firewall to limit the risk, which sounds like a risk treatment option. Since they're not transferring the risk or avoiding it, I think the answer is Mitigate.
CH
Charlene
1 year ago
Hmm, I'm a bit unsure about this one. The question mentions a legacy application that can't be patched, so I'm not sure if Mitigate is the right answer. Maybe it's Accept since they're just managing the risk instead of trying to eliminate it?
DE
Delfina
1 year ago
This seems like a straightforward risk management question. I think the answer is Mitigate, since the business is implementing a firewall to limit the risk exposure from the legacy application.
CH
Cheryl
1 year ago
Ah, I think I've seen this kind of issue before. It's probably an SSO authentication error.
JE
Jerry
1 year ago
I'm pretty confident the answer is C. Quinolones are the class of antibiotics that should not be taken with fruit juices or colas. I remember the professor emphasizing that in our last lecture.
CH
Chandra
1 year ago
I'm confident the software from my former employer is the superior option, so I'll just go ahead and purchase it. No need to overcomplicate things.
TA
Tasia
2 years ago
I still think it's more about mitigating the risk because the firewall is actively reducing the impact of potential threats.
RI
Richelle
2 years ago
That's a good point. It could be seen as both risk mitigation and risk transfer, depending on how you look at it.
MI
Mira
2 years ago
But couldn't this also fall under risk transfer by shifting the risk to the firewall?
TA
Tasia
2 years ago
I agree with Richelle. Implementing a firewall to protect the legacy application is a form of risk mitigation.
RI
Richelle
2 years ago
I think the risk treatment option applied in this case is to mitigate the risk.
TO
Tonja
2 years ago
I think the correct answer would be transferring the risk. They are not fully mitigating it, just shifting it to another component.
CH
Cheryll
2 years ago
I believe it's more of a risk transfer. The firewall is now handling the risk instead of the legacy application.
FE
Fernanda
2 years ago
But wouldn't that be transferring the risk to the firewall instead of fully mitigating it?
NA
Naomi
2 years ago
I agree with By implementing a firewall, they are trying to reduce the risk.
OL
Olen
2 years ago
I think the risk treatment option applied is to mitigate.
JE
Jenise
3 years ago
Hey, you know what they say - 'if you can't beat the firewall, join the firewall!' Am I right, guys? *laughs*
SH
Shonda
3 years ago
I'm with you on 'transfer' being the best answer. Putting a firewall in front of the legacy app is basically passing the risk on to the firewall, right? It's not really 'mitigating' the risk, it's just shifting it somewhere else.
TY
Ty
3 years ago
That's a good point. And if the legacy application can't be patched, then 'avoiding' the risk by not using the application is probably not an option. So 'mitigate' or 'transfer' seem like the most reasonable answers here.
TI
Tish
2 years ago
I agree. So, it must be either mitigate or transfer.
PE
Peter
2 years ago
True, avoiding the risk is not an option.
EL
Elbert
3 years ago
Hmm, I'm not so sure. Couldn't you argue that the firewall is a way to 'mitigate' the risk by limiting the exposure? It's not a complete solution, but it's better than just accepting the risk, right?
GE
Genevive
2 years ago
Exactly, the firewall is a form of risk transfer by placing a protective layer in front of the legacy application.
JU
Judy
2 years ago
C) Transfer
CH
Chaya
2 years ago
I think it's more of a 'transfer' because the firewall is shifting the risk to the barrier instead of accepting it.
DI
Diego
2 years ago
B) Accept
DE
Della
2 years ago
No, the firewall is actually a way to 'transfer' the risk by placing a barrier in front of the application.
SA
Sage
2 years ago
A) Mitigate
SO
Socorro
3 years ago
I agree, the wording of the question is a bit confusing. Implementing a firewall doesn't really 'avoid' the risk either, since the legacy application is still running. I'm leaning towards 'transfer' as the best answer.
BE
Bernardine
3 years ago
This question seems tricky. I'm not sure if implementing a firewall in front of the legacy application is exactly 'mitigating' the risk. It feels more like we're trying to 'transfer' the risk to the firewall.