SY0-701 Question 93
Single answerLegacyA manufacturing company still relies on a legacy industrial control server that runs an unsupported operating system. The server cannot be patched or upgraded because the vendor software is no longer certified on newer platforms, but the system must remain online to support production. During a security review, the administrator is asked to reduce the risk posed by this legacy system without disrupting operations. Which of the following is the BEST recommendation?
- A
Place the server on a dedicated, isolated network segment with tightly restricted access controls
- B
Expose the server directly to the internet so the vendor can remotely troubleshoot it when needed
- C
Disable logging on the server to reduce performance overhead and avoid system instability
- D
Install the latest unsupported patches from third-party websites to bring it up to date
Show answer and explanation
Correct answer: A
Explanation
Legacy systems are a recognized security challenge because they may be unsupported, unpatched, and difficult to replace due to operational dependencies. In Security+ scenarios, the best answer is often to apply compensating controls when direct remediation is not possible. Common best practices include network segmentation, isolation, least-privilege access, allowlisting, jump boxes, and continuous monitoring. Guidance from organizations such as NIST emphasizes limiting exposure and implementing layered controls for systems that cannot be fully remediated. For example, NIST SP 800-82 discusses protecting industrial control environments, and NIST SP 800-53 includes security controls related to network segmentation, access enforcement, and system monitoring. In this scenario, isolating the legacy server on a dedicated segment with tightly restricted access is the most effective and practical way to reduce risk without interrupting production.
- A. Correct.
Correct. When a legacy system cannot be patched or upgraded, compensating controls are the preferred risk-reduction approach. Network segmentation, isolation, and strict access control lists can significantly reduce exposure while allowing the system to continue operating. This is a common Security+ recommendation for unsupported or end-of-life systems that must remain in service.
- B. Incorrect.
Incorrect. Direct internet exposure greatly increases the attack surface of a legacy, unpatchable system. If vendor access is required, a more secure approach would be controlled remote access through a VPN, jump host, or other restricted management path. Choosing this option reflects the misconception that convenience for support outweighs the security risk.
- C. Incorrect.
Incorrect. Disabling logging removes visibility that defenders need for detection, investigation, and compliance. Legacy systems are already high risk, so retaining logs or forwarding them to a centralized monitoring solution is more appropriate. Someone might choose this if they are overly focused on availability and overlook the need for monitoring and accountability.
- D. Incorrect.
Incorrect. Applying unsupported patches from untrusted third-party sources introduces serious integrity and stability risks. It may also violate change management and vendor support requirements. This distractor targets the common but dangerous assumption that any patch is better than no patch.