How Should a Critical App on a Legacy Server Be Handled?

SY0-701 By islever Editorial Last updated

Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

Short answer

B Isolate the legacy server running the critical application from other systems to reduce exploit opportunities.

Question

Which of the following would be the best way to handle a critical business application that is running on a legacy server?
  1. Segmentation
  2. Isolation Correct Answer
  3. Hardening
  4. Decommissioning

Key Takeaways

The exam tests whether you distinguish network segmentation from full isolation for an unsupported legacy server; the trap is choosing segmentation because the application is critical, while the official guide recommends isolating unsupported apps as much as possible.

When a critical business application runs on a legacy server, CompTIA SY0-701 doctrine favors isolating the unsupported system from the rest of the network. This page establishes why isolation (B) is the best mitigation, how it differs from segmentation, and why hardening and decommissioning are not the primary answer.

Common mistake: Many learners pick Segmentation (A) because the application is critical and must stay available, but segmentation still leaves the legacy server reachable on the network; CompTIA's official guide specifically advises isolating unsupported systems to reduce exploit opportunities.

Expert Analysis

Why the Answer Is Correct

The scenario describes an unsupported legacy server running a critical application that cannot be replaced. The official CompTIA Security+ SY0-701 study guide states that for unsupported apps that cannot be replaced, the best strategy is to isolate them from other systems. Isolation (B) limits the attack surface by preventing the legacy server from communicating freely with the rest of the network, reducing the chance that a threat actor can exploit its vulnerabilities. Compensating controls such as increased monitoring, strict firewall rules, and restricted access can be applied while the application continues to run. This matches CompTIA's doctrine for legacy systems and makes B the best answer.

Why the Other Options Are Wrong

Segmentation (A) is a valuable security control, but it still places the legacy server on the network, where it remains reachable and can be targeted for lateral movement. The official guide specifically recommends isolation, not just segmentation, for unsupported systems. Hardening (C) is limited because a legacy OS no longer receives patches, and many modern hardening techniques may not be supported; it does not address the core risk of an unsupported system. Decommissioning (D) is impractical because the application is critical and must remain running, so removing the server is not an option.

Community Comment Notes

The comments are closely split, but those citing official sources favor isolation. Laura5859 quotes the CompTIA study guide's advice to "try to isolate them from other systems," and baronvon echoes that "best practice dictates isolating the system as much as possible." Etc_Shadow28000 argues for segmentation to limit impact, which is a reasonable defense-in-depth measure, but segmentation alone leaves the legacy server on the network. AutoroTink suggests hardening, yet hardening cannot compensate for an unsupported OS that lacks security updates. The vote tally (A:44, B:40) shows how tempting segmentation is, but the official body of knowledge points to isolation.

Exam Strategy

When you see a legacy or unsupported system in a scenario, think 'isolate or segment' rather than 'patch or harden.' CompTIA's official guide specifically recommends isolation for unsupported apps that cannot be replaced, so favor isolation when the question asks for the best way to handle the legacy system.

Frequently Asked Questions

Why is isolation better than segmentation for a legacy server?

CompTIA's official study guide advises isolating unsupported systems as much as possible; segmentation still leaves the server reachable on the network. Isolation reduces the attack surface more completely.

Can hardening compensate for a legacy server's missing patches?

Hardening helps but cannot fix an unsupported OS that no longer receives security updates. CompTIA recommends isolation plus compensating controls like monitoring and strict firewall rules.

More SY0-701 FAQ →

Community Votes

A
52%
B
48%

52% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 43 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 43

  1. Etc_Shadow28000 👍 20 Answered A
    A. Segmentation Segmentation is the best approach to handle a critical business application running on a legacy server. By segmenting the legacy server from the rest of the network, you can limit the potential impact of any vulnerabilities associated with the legacy system. This approach allows the critical application to continue running while minimizing the risk to the rest of the network. Therefore, the correct answer is: A. Segmentation
  2. AutoroTink 👍 9 Answered C
    Hardening involves implementing security measures to protect the application from threats while maintaining its availability. Segmentation and isolation can also be part of a security strategy, they are more about limiting access or separating the legacy system from other network segments, which might not be feasible for a critical business application that requires interaction with other systems.
  3. Laura5859 👍 5 Answered B
    The Official CompTIA Security+ Study Guide (Exam SY0-701) pg 32 has an explanation mark that says: "One strategy for dealing with unsupported apps that cannot be replaced is to try to isolate them from other systems. The idea is to reduce opportunities for a threat actor to access the vulnerable app and run exploit code. Using isolation as a substitute for patch management is an example of a compensating control."
  4. MAKOhunter33333333 👍 5 Answered A
    Isolation is like completely separate, while segmentation means it is still on the network providing service
  5. dbrowndiver 👍 3 Answered B
    Isolation is the best approach for handling a critical business application on a legacy server. It involves separating the legacy system from the rest of the network, thereby reducing the risk of security breaches affecting the broader network while still allowing the application to function as needed. Isolation: This approach involves creating a separate environment for the legacy system, preventing it from directly interacting with other network components. Isolation minimizes exposure to threats and limits the potential impact of vulnerabilities. In this Scenario Application:Security Risk Mitigation: By isolating the legacy server, the company can protect its network from potential vulnerabilities that the outdated system might introduce. This is crucial for critical applications that cannot be immediately upgraded or replaced. Isolation allows the application to continue running without immediate disruption, maintaining business continuity while planning for future upgrades or replacements. Why this is best over the other choices: Isolation balances the need to keep the application operational while protecting the rest of the network from potential risks associated with legacy systems.
Show 25 more comments
  1. a4e15bd 👍 3
    Isolation is used to completely separate a system from the network which is ideal if the primary goal is to eliminate any potential risk of legacy server compromising other systems. It is more extreme measure, typically applied when the application doesnt need to communicate with other systems or when the risk is deemed too high. Segmentation on the other hand is used to limit the legacy applications communication to only necessary interactions which still protects the rest of the network but allows the application to function normally. It is more nuanced approach allowing for controlled interactions while still reducing risk. So A. Segmentation is the best option because it provides a balance between security and functionality allow the legacy system to continue operating within a restricted and monitored environment.
  2. 585402e 👍 3 Answered A
    For this question i choose "Segmentation" but.. Segmentation is ideal when the legacy server requires internet access through the company's web proxy. It keeps the server within a secure, isolated network segment, ensuring it can access the internet while minimizing risks to other parts of the network. Isolation is the better approach when the legacy server only needs to be powered on for specific local operations. It provides a higher level of security by completely separating the server from other systems and network resources.
  3. baronvon 👍 3 Answered B
    B. Isolation The reason for this comes from the CompTIA Security+ study guide: "In cases where the organization simply must continue using an unsupported operating system, best practice dictates isolating the system as much as possible, preferably not connecting it to any network, and applying as many compensating security controls as possible, such as increased monitoring and implementing strict network firewall rules."
  4. Phatcharaphon 👍 3 Answered B
    Isolation is the most effective approach to ensure the legacy system is protected while continuing to support critical business functions, making B the correct choice.
  5. Shaman73 👍 3
    • B. Isolation Segmentation, wenn die Application mehrere Systeme bräuchte; Härtung geht nicht mehr; Decommissioning noch nicht….
  6. Ty13 👍 2 Answered B
    B. Isolation Segmenting a network means breaking the network into smaller subnets, like one for HR, one for Payroll, one for Management, etc. The idea being that you can end connections to one segment entirely in the event of a compromise, without impacting other segments. Isolation is just the next step further - if a device is old and unsupported, like Windows XP, then you'd want to have it completely on its own where it can't touch the rest of the network inappropriately.
  7. Laura5859 👍 2
    The Official CompTIA Security+ Study Guide (Exam SY0-701) has an explanation mark that says: "One strategy for dealing with unsupported apps that cannot be replaced is to try to isolate them from other systems. The idea is to reduce opportunities for a threat actor to access the vulnerable app and run exploit code. Using isolation as a substitute for patch management is an example of a compensating control."
  8. Punjistetics 👍 2 Answered B
    B. Isolation Isolation would be the best approach for handling a critical business application running on a legacy server. By isolating the legacy server, you minimize its exposure to potential security threats and reduce the risk of compromising other parts of the network. This allows you to maintain the functionality of the critical application while also enhancing security.
  9. SHADTECH123 👍 2 Answered B
    Isolation involves separating the legacy server from other parts of the network to minimize potential security risks while maintaining its operational role. This can help protect the rest of the network from vulnerabilities associated with the legacy system, ensuring that the critical application remains secure and functional.
  10. e5c1bb5 👍 2 Answered A
    segmentation because the device is STILL running a critical application. therefore it needs to be connected to the network. a compensating mechanism for this scenario would be segmentation as this would limit the ability of an attacker to pivot from the vulnerable server to the rest of the network.
  11. laternak26 👍 2 Answered B
    Given the constraints associated with legacy systems, B. Isolation is the most practical approach to mitigate security risks. By isolating the legacy server, you can protect it and the broader network from potential vulnerabilities.
  12. c7b3ff0 👍 2 Answered B
    My study guide says isolation is the answer and its really seems like it could also situationally be A. I hate how some of these questions are constructed. I guess I'd go B on the test.
  13. 3dk1 👍 2 Answered A
    It is not Isolation. Isolation would mean blocking access altogether... That means it is either A or C. I am going with A though.
  14. ok_im_here 👍 2 Answered B
    After reading the Comptia book and asking several AI tools, B seems to be the right answer.
  15. JoeRealCool 👍 1 Answered A
    In this situation, I don't think hardening makes sense. Because it is a legacy system, it will still be vulnerable regardless of the security configuration of the system. If you add a firewall before the server, that starts to become segmentation. I also think that there is a theme here with the question bank for these types of questions where the answer for dealing with legacy servers is either segmentation or compensating controls. Decommissioning would be the best way but I don't think it works for this particular question because it doesn't recommend what to do after decommissioning so that the critical application can still run. Isolation doesn't make sense because then the network can't access the critical application. I hate these types of questions.
  16. 9547adc 👍 1
    Isolation because Segmentation involves dividing a network into separate segments or zones to control the flow of traffic and limit the scope of potential security breaches. It's typically applied at the network level to create boundaries between different parts of a network, such as separating internal networks from external ones or segmenting departments within an organization. Isolation, on the other hand, focuses on physically or logically separating a specific system, application, or resource from the rest of the network or environment. It involves placing the critical business application on its own server or within its own isolated environment to reduce the risk of unauthorized access or compromise.
  17. NoobusAurelius 👍 1
    Answer is A. Segmentation, if you read the question it says critical Business application, isolating the server would impact it's ability to interact with other systems on the Network and therefore Business Operations will be affected. Hardening has the potential to affect server performance and being a legacy server it may not be compatible with current software, hardware or other hardening techniques. Decommisioning could be an option if the application can be migrated out of hours to a brand new server, but that isn't really what the question is alluding to.
  18. ProudFather 👍 1 Answered D
    D. Decommissioning While segmentation, isolation, and hardening can be useful security measures, the best long-term solution for a legacy application is to decommission it and replace it with a more modern and secure alternative. Legacy systems are often difficult to patch, update, and secure, making them prime targets for cyberattacks. By decommissioning the legacy server, the organization can reduce its attack surface and improve its overall security posture.
  19. 93d818a 👍 1 Answered B
    In the context of the CompTIA Security+ (SY0-701) Exam Objectives, managing legacy systems is crucial due to their inherent security challenges. These systems often lack vendor support, making them susceptible to vulnerabilities. To mitigate risks associated with legacy systems, isolation is a recommended strategy. Isolating legacy systems involves restricting their network access to essential communications only, thereby reducing potential attack vectors
  20. WOW_ThatsCrazy 👍 1 Answered B
    Isolation is the process of separating the legacy system from the rest of the network to reduce the risk of vulnerabilities being exploited. This approach allows the legacy application to continue operating while minimizing its exposure to potential threats. Segmentation is similar but generally applies to creating separate network segments for security. However, isolation goes further by limiting interactions strictly to what is necessary.
  21. dC_Furious 👍 1
    A Segmentation This is a critical business application if the system is isolated it would not function properly segmentation would Allow the legacy server to continue operating within the network while restricting its communication to only necessary systems and users. This reduces the attack surface and helps protect the rest of the network from potential vulnerabilities associated with the legacy server.
  22. dbrowndiver 👍 1 Answered B
    Not Fully Isolated: While segmentation improves security, it doesn't offer the complete separation provided by isolation. If the legacy server is compromised, segmentation might not prevent the spread of threats as effectively as isolation. Complex Implementation: Requires careful planning to ensure correct segmentation, which can introduce complexity without providing the full benefits of isolation.
  23. Anyio 👍 1 Answered A
    A. Segmentation. Segmentation isolates the legacy server within the network, minimizing the attack surface while still allowing necessary communication. Other options: B-Isolation may be too restrictive C-Hardening is limited due to outdated systems D-Decommissioning isn't viable for critical applications. Segmentation provides a balanced approach, enhancing security while maintaining functionality.
  24. Konversation 👍 1 Answered B
    B. Isolation CompTIA Sec+ Student Guide - Unsupported systems and Applications: "One strategy for dealing with unsupported apps that cannot be replaced is to try to isolate them from other systems. The idea is to reduce opportunities for a threat actor to access the vulnerable app and run exploit code. Using isolation as a substitute for patch management is an example of a compensating control."
  25. cdsu 👍 1
    B. Isolation ...managing a critical business application on a legacy server. By separating the legacy server from the rest of the network to prevent potential threats from spreading. This way effective in protecting the critical application from vulnerabilities inherent to the legacy system.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide