Isaca Exam CISM Topic 2 Question 70 Discussion

Actual exam question for Isaca's CISM exam

Question #: 70
Topic #: 2

[All CISM Questions]

A business requires a legacy version of an application to operate but the application cannot be patched. To limit the risk exposure to the business, a firewall is implemented in front of the legacy application. Which risk treatment option has been applied?

AMitigate

BAccept

CTransfer

DAvoid

Show Suggested Answer

Suggested Answer: A

Mitigate is the risk treatment option that has been applied by implementing a firewall in front of the legacy application because it helps to reduce the impact or probability of a risk. Mitigate is a process of taking actions to lessen the negative effects of a risk, such as implementing security controls, policies, or procedures. A firewall is a security device that monitors and filters the network traffic between the legacy application and the external network, blocking or allowing packets based on predefined rules. A firewall helps to mitigate the risk of unauthorized access, exploitation, or attack on the legacy application that cannot be patched. Therefore, mitigate is the correct answer.

https://simplicable.com/risk/risk-treatment

https://resources.infosecinstitute.com/topic/risk-treatment-options-planning-prevention/

https://www.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment.

by Xuan at Apr 10, 2024, 08:20 PM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tasia

12 months ago

I still think it's more about mitigating the risk because the firewall is actively reducing the impact of potential threats.

upvoted 0 times

...

Richelle

12 months ago

That's a good point. It could be seen as both risk mitigation and risk transfer, depending on how you look at it.

upvoted 0 times

...

Mira

1 years ago

But couldn't this also fall under risk transfer by shifting the risk to the firewall?

upvoted 0 times

...

Tasia

1 years ago

I agree with Richelle. Implementing a firewall to protect the legacy application is a form of risk mitigation.

upvoted 0 times

...

Richelle

1 years ago

I think the risk treatment option applied in this case is to mitigate the risk.

upvoted 0 times

...

Tonja

1 years ago

I think the correct answer would be transferring the risk. They are not fully mitigating it, just shifting it to another component.

upvoted 0 times

...

Cheryll

1 years ago

I believe it's more of a risk transfer. The firewall is now handling the risk instead of the legacy application.

upvoted 0 times

...

Fernanda

1 years ago

But wouldn't that be transferring the risk to the firewall instead of fully mitigating it?

upvoted 0 times

...

Naomi

1 years ago

I agree with By implementing a firewall, they are trying to reduce the risk.

upvoted 0 times

...

Olen

1 years ago

I think the risk treatment option applied is to mitigate.

upvoted 0 times

...

Jenise

1 years ago

Hey, you know what they say - 'if you can't beat the firewall, join the firewall!' Am I right, guys? *laughs*

upvoted 0 times

...

Shonda

1 years ago

I'm with you on 'transfer' being the best answer. Putting a firewall in front of the legacy app is basically passing the risk on to the firewall, right? It's not really 'mitigating' the risk, it's just shifting it somewhere else.

upvoted 0 times

...

Ty

1 years ago

That's a good point. And if the legacy application can't be patched, then 'avoiding' the risk by not using the application is probably not an option. So 'mitigate' or 'transfer' seem like the most reasonable answers here.

upvoted 0 times

Tish

1 years ago

I agree. So, it must be either mitigate or transfer.

upvoted 0 times

...

Peter

1 years ago

True, avoiding the risk is not an option.

upvoted 0 times

...

Elbert

1 years ago

Hmm, I'm not so sure. Couldn't you argue that the firewall is a way to 'mitigate' the risk by limiting the exposure? It's not a complete solution, but it's better than just accepting the risk, right?

upvoted 0 times

Genevive

1 years ago

Exactly, the firewall is a form of risk transfer by placing a protective layer in front of the legacy application.

upvoted 0 times

...

Judy

1 years ago

C) Transfer

upvoted 0 times

...

Chaya

1 years ago

I think it's more of a 'transfer' because the firewall is shifting the risk to the barrier instead of accepting it.

upvoted 0 times

...

Diego

1 years ago

B) Accept

upvoted 0 times

...

Della

1 years ago

No, the firewall is actually a way to 'transfer' the risk by placing a barrier in front of the application.

upvoted 0 times

...

Sage

1 years ago

A) Mitigate

upvoted 0 times

...

Socorro

1 years ago

I agree, the wording of the question is a bit confusing. Implementing a firewall doesn't really 'avoid' the risk either, since the legacy application is still running. I'm leaning towards 'transfer' as the best answer.

upvoted 0 times

...

Bernardine

1 years ago

This question seems tricky. I'm not sure if implementing a firewall in front of the legacy application is exactly 'mitigating' the risk. It feels more like we're trying to 'transfer' the risk to the firewall.

upvoted 0 times

...