Legacy Systems Security Concerns: Vendor Support vs Insecure Protocols

SY0-701 By islever Editorial Last updated

Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

Short answer

B The lack of vendor support is the most important security concern because it prevents the application of security patches and fixes for newly discovered vulnerabilities.

Question

Which of the following is the most important security concern when using legacy systems to provide production service?
  1. Instability
  2. Lack of vendor support Correct Answer
  3. Loss of availability
  4. Use of insecure protocols

Key Takeaways

The exam tests your ability to prioritize systemic unpatchability over specific protocol weaknesses when evaluating legacy infrastructure.

This question addresses the primary security risk of legacy systems in production, distinguishing between technical vulnerabilities like insecure protocols and operational risks like lack of vendor support.

Common mistake: Many learners select 'Use of insecure protocols' because it is a direct technical vulnerability, but they miss that without vendor support, these protocols cannot be remediated or patched.

Expert Analysis

Why the Answer Is Correct

Lack of vendor support is the most critical concern because it creates an unresolvable security debt. Without patches or updates, any known vulnerability, including those in insecure protocols, remains permanently exploitable. This transforms a manageable risk into a persistent, high-severity threat that cannot be mitigated through standard maintenance.

Why the Other Options Are Wrong

While instability (A) affects reliability rather than security directly, and loss of availability (C) is an outcome rather than a root cause, both are secondary to the inability to fix flaws. Use of insecure protocols (D) is indeed a major issue, but it is often a symptom of the lack of support; if support existed, protocols could be updated or replaced.

Community Comment Notes

Community consensus strongly favors B, with users noting that "without vendor support, there are no updates... leaving them exposed" as per user 2fef490. User BluezClues argued that insecure protocols can be wrapped in secure channels, whereas lack of support prevents fixing the underlying system, a point echoed by user a0bfa81 regarding essential security updates.

Exam Strategy

When analyzing legacy systems, always look for the option that implies an inability to remediate issues. If a system cannot be patched or supported, all other vulnerabilities become unmanageable, making lack of support the highest priority concern.

Frequently Asked Questions

Why isn't use of insecure protocols the correct answer?

Insecure protocols are a vulnerability, but they can sometimes be mitigated via network controls. Lack of vendor support means you cannot patch the system itself, making the risk permanent.

Does lack of vendor support always mean no security patches?

Yes, typically. It implies the vendor has ended lifecycle support, so no new security updates or hotfixes will be released for identified threats.

More SY0-701 FAQ →

Community Votes

B
58%
D
42%

58% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 19 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 19

  1. 2fef490 👍 7 Answered B
    The most important security concern with legacy systems is the lack of vendor support. Without vendor support, there are no updates, security patches, or fixes for newly discovered vulnerabilities. This leaves the system exposed to potential attacks that cannot be easily mitigated, increasing the risk of security breaches.
  2. jbmac 👍 5 Answered D
    The correct answer is: D. Use of insecure protocols Explanation: Use of insecure protocols is the most critical security concern when using legacy systems to provide production services. Legacy systems often rely on outdated protocols that lack modern security features (such as encryption and secure authentication), making them vulnerable to various types of attacks (e.g., man-in-the-middle attacks, eavesdropping, etc.). These vulnerabilities can expose sensitive data and compromise the integrity of the system.
  3. BluezClues 👍 5 Answered B
    B. Lack of Vendor Support Why it isn't D. Use of Protocols: Many legacy systems use outdated and insecure protocols, which is certainly a concern, but insecure protocols can often be mitigated by wrapping them in secure communication channels (e.g., VPNs, encryption). The lack of vendor support to address these insecure protocols is actually a greater problem than their presence because there’s no way to patch or upgrade them without vendor assistance.
  4. laternak26 👍 3 Answered D
    D. Use of insecure protocols: Legacy systems often rely on outdated protocols that are no longer considered secure by modern standards. These systems may use protocols that are vulnerable to attacks like eavesdropping, man-in-the-middle attacks, or data tampering because they do not support strong encryption or authentication methods.
  5. a0bfa81 👍 3 Answered B
    The most important security concern when using legacy systems is the lack of vendor support. Without vendor support, legacy systems may not receive essential security updates, patches, or technical assistance, leaving them vulnerable to known exploits and threats. This can significantly increase the risk of security breaches.
Show 14 more comments
  1. Cee007 👍 3 Answered D
    The answer is D. Legacy systems rely on outdated protocols which often contain vulnerabilities that attackers can exploit. They may also lack the security features to protect against modern threats.
  2. cyoncon 👍 3 Answered B
    Primary concern is vendor support.
  3. User92 👍 2 Answered D
    Given answer is correct - because legacy systems often rely on outdated and insecure protocols that can be easily exploited.
  4. AndyK2 👍 2 Answered B
    No ongoing security updates No patches for newly discovered vulnerabilities
  5. Examplary 👍 1 Answered D
    Legacy Systems - Outdated computing software, hardware, or other technologies that have been largely superseded by newer and more efficient alternatives. Unsupported Systems - Hardware or software products that no longer receive official technical support, security updates, or patches from their respective vendors or developers. Just because something is legacy does not mean that it's no longer supported by the vendor. However, it does mean that it is likely using outdated technologies/protocols. I vote D.
  6. Ina22 👍 1
    D. Use of insecure protocols. Legacy systems often rely on outdated protocols that may not have the necessary security features to protect against modern threats. This can lead to vulnerabilities that attackers can exploit, compromising the integrity, confidentiality, and availability of the system and its data.
  7. fc040c7 👍 1 Answered B
    Legacy items are typically unsupported. Honestly if you look through all the questions dealing with legacy items they point you toward using a compensation control (segmentation/firewall usage/isolation) because of the lack of support through patching/updates
  8. TonyStarChillingFromHeaven 👍 1 Answered A
    A - Lack of Vendor Support. Insecure protocols are a major concern, but they are often a symptom of the broader issue of lack of support and updates.
  9. 3dk1 👍 1
    The more I think about it, the more I realize that legacy systems could still have secure protocols. I am going with lack of vendor support.
  10. jafyyy 👍 1
    D Legacy systems rely on outdated and insecure protocols with known vulnerabilities.
  11. Syl0 👍 1
    hmmm, if it's security concern, shouldn't it be D use of insecure protocol?
  12. nyyankee718 👍 1 Answered B
    insecure protocol is an issue but would be greater without vender support
  13. NONS3c 👍 1 Answered D
    it is correct
  14. 17f9ef0 👍 1 Answered D
    Answer is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide