Which Method Most Likely Identifies Legacy Systems?
Short answer
B Vulnerability scan
Question
Key Takeaways
The exam tests your ability to match security techniques to their real-world purpose; the trap is choosing package monitoring because it sounds version-related, but vulnerability scans are specifically designed to inventory and assess the security posture of existing systems.
According to community consensus and Security+ exam guidance, vulnerability scanning is the primary method for identifying legacy systems, as it flags outdated software, unsupported OS versions, and unpatched devices.
Common mistake: Selecting Package monitoring (C) is the most common error because it seems relevant to tracking software versions, but package monitoring focuses on open-source dependencies and known vulnerabilities in those packages, not on detecting end-of-life or legacy internal systems.
Expert Analysis
Why the Answer Is Correct
Vulnerability scanning is the standard method for identifying legacy systems because it actively reviews networks and endpoints for outdated software, missing patches, and unsupported OS versions. As comment [1] notes, a vulnerability scan 'assesses systems for known vulnerabilities, outdated software versions, and unsupported systems,' making it the natural choice for this task. Comment [2] reinforces this by pointing out that vulnerability scans 'can include outdated software versions and unpatched systems.' Thus, the scan provides the inventory and security data needed to spot legacy assets.
Why the Other Options Are Wrong
A bug bounty program (A) is a crowd-sourced effort to find exploitable vulnerabilities in an organization's own applications or systems; it relies on external researchers and does not systematically inventory all systems. Package monitoring (C) specifically tracks open-source software libraries for known CVEs, not the age or support status of an entire legacy system. Dynamic analysis (D) involves executing code to observe behavior, which is useful for testing specific applications but not for discovering legacy devices across an environment.
Community Comment Notes
Comment [1] provides a clear, high-quality explanation that directly supports answer B and outlines why the other methods are less appropriate. Comment [2] adds a concise confirmation from a different angle, emphasizing that vulnerability scans cover outdated software and unpatched systems. Comment [3] raises a reasonable counterpoint about package monitoring, but the expert consensus and the exam's intended scope align on vulnerability scanning as the broadest and most likely method for identifying legacy systems.
Official Reference
These links open the official vendor documentation in a new tab.
Exam Strategy
When a question asks about identifying legacy systems, remember that vulnerability scanning is the broadest method for discovering outdated and unsupported assets. Do not confuse package monitoring with system-level legacy detection—package monitoring only tracks third-party libraries in a supply chain context.
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Murtuza 👍 4 Answered BThe method most likely used to identify legacy systems is: B. Vulnerability scan. A vulnerability scan assesses systems for known vulnerabilities, outdated software versions, and unsupported systems. This makes it an effective way to identify legacy systems that may no longer be receiving security updates or support. A. Bug bounty program: This focuses on crowdsourcing the identification of specific vulnerabilities but is not primarily aimed at identifying legacy systems. C. Package monitoring: Tracks software packages for updates, but it doesn't specifically target legacy systems. D. Dynamic analysis: Involves testing software during runtime for vulnerabilities but is not typically used to identify legacy systems. A vulnerability scan is the most effective approach for identifying legacy systems in an environment
-
jafyyy 👍 1C. Vulnerability Scan - can identify legacy systems as it can include outdated software versions and unpatched systems.
-
Cyberity 👍 1Shouldnt the answer be Package Monitoring ?
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →