Isaca Exam CISM Topic 2 Question 70 Discussion

Actual exam question for Isaca's Certified Information Security Manager exam

Question #: 70
Topic #: 2

[All Certified Information Security Manager Questions]

A business requires a legacy version of an application to operate but the application cannot be patched. To limit the risk exposure to the business, a firewall is implemented in front of the legacy application. Which risk treatment option has been applied?

AMitigate

BAccept

CTransfer

DAvoid

Show Suggested Answer

Suggested Answer: A

Mitigate is the risk treatment option that has been applied by implementing a firewall in front of the legacy application because it helps to reduce the impact or probability of a risk. Mitigate is a process of taking actions to lessen the negative effects of a risk, such as implementing security controls, policies, or procedures. A firewall is a security device that monitors and filters the network traffic between the legacy application and the external network, blocking or allowing packets based on predefined rules. A firewall helps to mitigate the risk of unauthorized access, exploitation, or attack on the legacy application that cannot be patched. Therefore, mitigate is the correct answer.

https://simplicable.com/risk/risk-treatment

https://resources.infosecinstitute.com/topic/risk-treatment-options-planning-prevention/

https://www.enisa.europa.eu/topics/risk-management/current-risk/risk-management-inventory/rm-process/risk-treatment.

by Xuan at Apr 10, 2024, 08:20 PM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Naomi

1 days ago

I agree with By implementing a firewall, they are trying to reduce the risk.

upvoted 0 times

...

Olen

2 days ago

I think the risk treatment option applied is to mitigate.

upvoted 0 times

...

Jenise

24 days ago

Hey, you know what they say - 'if you can't beat the firewall, join the firewall!' Am I right, guys? *laughs*

upvoted 0 times

...

Shonda

26 days ago

I'm with you on 'transfer' being the best answer. Putting a firewall in front of the legacy app is basically passing the risk on to the firewall, right? It's not really 'mitigating' the risk, it's just shifting it somewhere else.

upvoted 0 times

...

Ty

27 days ago

That's a good point. And if the legacy application can't be patched, then 'avoiding' the risk by not using the application is probably not an option. So 'mitigate' or 'transfer' seem like the most reasonable answers here.

upvoted 0 times

...

Elbert

28 days ago

Hmm, I'm not so sure. Couldn't you argue that the firewall is a way to 'mitigate' the risk by limiting the exposure? It's not a complete solution, but it's better than just accepting the risk, right?

upvoted 0 times

Genevive

7 days ago

Exactly, the firewall is a form of risk transfer by placing a protective layer in front of the legacy application.

upvoted 0 times

...

Judy

8 days ago

C) Transfer

upvoted 0 times

...

Chaya

9 days ago

I think it's more of a 'transfer' because the firewall is shifting the risk to the barrier instead of accepting it.

upvoted 0 times

...

Diego

10 days ago

B) Accept

upvoted 0 times

...

Della

11 days ago

No, the firewall is actually a way to 'transfer' the risk by placing a barrier in front of the application.

upvoted 0 times

...

Sage

12 days ago

A) Mitigate

upvoted 0 times

...

Socorro

1 months ago

I agree, the wording of the question is a bit confusing. Implementing a firewall doesn't really 'avoid' the risk either, since the legacy application is still running. I'm leaning towards 'transfer' as the best answer.

upvoted 0 times

...

Bernardine

1 months ago

This question seems tricky. I'm not sure if implementing a firewall in front of the legacy application is exactly 'mitigating' the risk. It feels more like we're trying to 'transfer' the risk to the firewall.

upvoted 0 times

...