Isaca Exam CISM Topic 2 Question 70 Discussion

Actual exam question for Isaca's Certified Information Security Manager exam

Question #: 70
Topic #: 2

[All Certified Information Security Manager Questions]

A business requires a legacy version of an application to operate but the application cannot be patched. To limit the risk exposure to the business, a firewall is implemented in front of the legacy application. Which risk treatment option has been applied?

AMitigate

BAccept

CTransfer

DAvoid

Show Suggested Answer

Suggested Answer: A

Mitigate is the risk treatment option that has been applied by implementing a firewall in front of the legacy application because it helps to reduce the impact or probability of a risk. Mitigate is a process of taking actions to lessen the negative effects of a risk, such as implementing security controls, policies, or procedures. A firewall is a security device that monitors and filters the network traffic between the legacy application and the external network, blocking or allowing packets based on predefined rules. A firewall helps to mitigate the risk of unauthorized access, exploitation, or attack on the legacy application that cannot be patched. Therefore, mitigate is the correct answer.

https://simplicable.com/risk/risk-treatment

https://resources.infosecinstitute.com/topic/risk-treatment-options-planning-prevention/

https://www.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment.

by Xuan at Apr 10, 2024, 08:20 PM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Comments

Submit Cancel

Bernardine

1 days ago

This question seems tricky. I'm not sure if implementing a firewall in front of the legacy application is exactly 'mitigating' the risk. It feels more like we're trying to 'transfer' the risk to the firewall.

upvoted 0 times

...