CAS-003 · Question #571
Due to a recent acquisition, the security team must find a way to secure several legacy applications. During a review of the applications, the following issues are documented: - The applications are…
The correct answer is D. Move the applications to virtual servers that meet the password and account standards. The provided correct answer is D - moving to virtual servers that meet password and account standards addresses the non-compliant credentials issue. However, note that option C (network segmentation to isolate the applications and control access) is widely considered the…
Question
Due to a recent acquisition, the security team must find a way to secure several legacy applications. During a review of the applications, the following issues are documented:
- The applications are considered mission-critical.
- The applications are written in code languages not currently supported by the development staff.
- Security updates and patches will not be made available for the applications.
- Username and passwords do not meet corporate standards.
- The data contained within the applications includes both PII and PHI.
- The applications communicate using TLS 1.0.
- Only internal users access the applications.
Which of the following should be utilized to reduce the risk associated with these applications and their current architecture?
Options
- AUpdate the company policies to reflect the current state of the applications so they are not out
- BCreate a group policy to enforce password complexity and username requirements.
- CUse network segmentation to isolate the applications and control access.
- DMove the applications to virtual servers that meet the password and account standards.
How the community answered
(40 responses)- A30% (12)
- B15% (6)
- C8% (3)
- D48% (19)
Explanation
The provided correct answer is D - moving to virtual servers that meet password and account standards addresses the non-compliant credentials issue. However, note that option C (network segmentation to isolate the applications and control access) is widely considered the industry-standard compensating control for legacy systems that cannot be patched: it limits the blast radius by restricting who can reach the applications, regardless of their TLS 1.0 usage, missing patches, or unsupported code. Option A (updating policies to match current state) reduces compliance on paper without reducing actual risk. Option B (group policy for password complexity) may not apply to applications using their own credential stores. In practice, combining network segmentation (C) with strict access control would address more of the listed risks than moving to virtual servers alone.
Topics
Community Discussion
No community discussion yet for this question.