Which Method Most Likely Identifies Legacy Systems?
Which of the following methods would most likely be used to identify legacy systems?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your ability to match security techniques to their real-world purpose; the trap is choosing package monitoring because it sounds version-related, but vulnerability scans are specifically designed to inventory and assess the security posture of existing systems.
According to community consensus and Security+ exam guidance, vulnerability scanning is the primary method for identifying legacy systems, as it flags outdated software, unsupported OS versions, and unpatched devices.
Selecting Package monitoring (C) is the most common error because it seems relevant to tracking software versions, but package monitoring focuses on open-source dependencies and known vulnerabilities in those packages, not on detecting end-of-life or legacy internal systems.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Vulnerability scanning is the standard method for identifying legacy systems because it actively reviews networks and endpoints for outdated software, missing patches, and unsupported OS versions. As comment [1] notes, a vulnerability scan 'assesses systems for known vulnerabilities, outdated software versions, and unsupported systems,' making it the natural choice for this task. Comment [2] reinforces this by pointing out that vulnerability scans 'can include outdated software versions and unpatched systems.' Thus, the scan provides the inventory and security data needed to spot legacy assets.Why the Other Options Are Wrong
A bug bounty program (A) is a crowd-sourced effort to find exploitable vulnerabilities in an organization's own applications or systems; it relies on external researchers and does not systematically inventory all systems. Package monitoring (C) specifically tracks open-source software libraries for known CVEs, not the age or support status of an entire legacy system. Dynamic analysis (D) involves executing code to observe behavior, which is useful for testing specific applications but not for discovering legacy devices across an environment.Community Comment Notes
Comment [1] provides a clear, high-quality explanation that directly supports answer B and outlines why the other methods are less appropriate. Comment [2] adds a concise confirmation from a different angle, emphasizing that vulnerability scans cover outdated software and unpatched systems. Comment [3] raises a reasonable counterpoint about package monitoring, but the expert consensus and the exam's intended scope align on vulnerability scanning as the broadest and most likely method for identifying legacy systems.Official Reference
Exam Strategy
When a question asks about identifying legacy systems, remember that vulnerability scanning is the broadest method for discovering outdated and unsupported assets. Do not confuse package monitoring with system-level legacy detection—package monitoring only tracks third-party libraries in a supply chain context.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →