SY0-701 Question 90
Single answerEnd-of-lifeA hospital's security team discovers that a critical radiology workstation is still running an operating system that reached end-of-life last year. The vendor has not released security patches since support ended, but the workstation must remain online temporarily because a replacement system will not be installed for 60 days. The workstation communicates with imaging devices and a records server on the internal network. Which action is the BEST way to reduce security risk during this interim period?
- A
Place the workstation on an isolated VLAN with tightly restricted firewall rules that allow only required communications, and closely monitor it for suspicious activity
- B
Leave the workstation in its current network segment and rely on antivirus signatures to detect any malicious activity
- C
Increase the workstation user's password length and require more frequent password changes until the replacement arrives
- D
Disable logging on the workstation to improve performance and reduce the chance of service interruption
Show answer and explanation
Correct answer: A
Explanation
End-of-life systems present elevated security risk because the vendor no longer provides patches, bug fixes, or often technical support. In a real-world environment, especially in healthcare or industrial settings, immediate replacement is not always possible. Security best practice is to treat such systems as high risk and implement compensating controls: isolate them through network segmentation, limit communications to only required hosts and ports, monitor them closely, and develop a documented replacement or decommission plan. This approach aligns with common guidance from organizations such as NIST, including risk management and vulnerability management practices that emphasize reducing exposure when remediation is not immediately possible. Simply relying on antivirus or password changes does not sufficiently address unpatched vulnerabilities, and reducing logging would make an already risky situation worse.
- A. Correct.
Correct. When a system is end-of-life and no longer receives security patches, compensating controls are the most appropriate risk-reduction measure if the asset cannot be immediately replaced. Network segmentation, restrictive access control lists or firewall rules, and enhanced monitoring reduce the attack surface and help contain compromise. This is a practical and commonly recommended approach for unsupported legacy systems that must remain operational for business or patient-care reasons.
- B. Incorrect.
Incorrect. Antivirus can help detect some threats, but it does not address the core problem of an unpatched, unsupported operating system with known vulnerabilities. Leaving the workstation on the normal network increases the likelihood of lateral movement or exploitation. A common misconception is that endpoint protection alone can compensate for end-of-life status; in practice, it should be only one layer of defense, not the primary control.
- C. Incorrect.
Incorrect. Stronger password controls may improve authentication security, but they do little to mitigate vulnerabilities caused by missing security patches in an end-of-life operating system. An attacker could exploit remote code execution or privilege escalation flaws without needing to guess a password. This option reflects the common mistake of applying a generic security control that does not address the specific risk.
- D. Incorrect.
Incorrect. Disabling logging reduces visibility and incident detection capability, which is especially dangerous for a high-risk legacy asset. Unsupported systems should generally receive more monitoring, not less. Although performance concerns may be real in operational environments, turning off logs weakens detective controls and makes incident response more difficult.