What Is the Primary Security Risk of Legacy Systems in Production?
Which of the following is the most important security concern when using legacy systems to provide production service?
Community Votes
58% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests your understanding of vulnerability management and risk prioritization, with the common trap being the focus on visible symptoms like insecure protocols rather than the underlying root cause: discontinued vendor support.
Legacy systems pose significant security risks due to their age and outdated architecture, but the most critical concern is the lack of vendor support. Community consensus confirms that without ongoing updates and patches, organizations cannot mitigate newly discovered vulnerabilities, making unsupported systems the highest priority risk.
Candidates frequently select 'Use of insecure protocols' because it directly relates to network traffic and encryption weaknesses; however, this is often a manageable symptom that can be mitigated through compensating controls like network segmentation or encrypted tunnels, unlike the unpatchable nature of unsupported software.
Community Discussion (20 comments)
2fef490
👍 7
Selected: B
The most important security concern with legacy systems is the lack of vendor support. Without vendor support, there are no updates, security patches, or fixes for newly discovered vulnerabilities. This leaves the system exposed to potential attacks that cannot be easily mitigated, increasing the risk of security breaches.
jbmac
👍 5
Selected: D
The correct answer is: D. Use of insecure protocols Explanation: Use of insecure protocols is the most critical security concern when using legacy systems to provide production services. Legacy systems often rely on outdated protocols that lack modern security features (such as encryption and secure authentication), making them vulnerable to various types of attacks (e.g., man-in-the-middle attacks, eavesdropping, etc.). These vulnerabilities can expose sensitive data and compromise the integrity of the system.
fc040c7
👍 1
Selected: B
Legacy items are typically unsupported. Honestly if you look through all the questions dealing with legacy items they point you toward using a compensation control (segmentation/firewall usage/isolation) because of the lack of support through patching/updates
TonyStarChillingFromHeaven
👍 1
Selected: A
A - Lack of Vendor Support. Insecure protocols are a major concern, but they are often a symptom of the broader issue of lack of support and updates.
laternak26
👍 3
Selected: D
D. Use of insecure protocols: Legacy systems often rely on outdated protocols that are no longer considered secure by modern standards. These systems may use protocols that are vulnerable to attacks like eavesdropping, man-in-the-middle attacks, or data tampering because they do not support strong encryption or authentication methods.
AndyK2
👍 2
Selected: B
No ongoing security updates No patches for newly discovered vulnerabilities
3dk1
👍 1
The more I think about it, the more I realize that legacy systems could still have secure protocols. I am going with lack of vendor support.
User92
👍 2
Selected: D
Given answer is correct - because legacy systems often rely on outdated and insecure protocols that can be easily exploited.
cyoncon
👍 3
Selected: B
Primary concern is vendor support.
BluezClues
👍 5
Selected: B
B. Lack of Vendor Support Why it isn't D. Use of Protocols: Many legacy systems use outdated and insecure protocols, which is certainly a concern, but insecure protocols can often be mitigated by wrapping them in secure communication channels (e.g., VPNs, encryption). The lack of vendor support to address these insecure protocols is actually a greater problem than their presence because there’s no way to patch or upgrade them without vendor assistance.
BluezClues
👍 3
B. Lack of Vendor Support Why it isn't D. Use of Protocols: Many legacy systems use outdated and insecure protocols, which is certainly a concern, but insecure protocols can often be mitigated by wrapping them in secure communication channels (e.g., VPNs, encryption). The lack of vendor support to address these insecure protocols is actually a greater problem than their presence because there’s no way to patch or upgrade them without vendor assistance.
a0bfa81
👍 3
Selected: B
The most important security concern when using legacy systems is the lack of vendor support. Without vendor support, legacy systems may not receive essential security updates, patches, or technical assistance, leaving them vulnerable to known exploits and threats. This can significantly increase the risk of security breaches.
nyyankee718
👍 1
Selected: B
insecure protocol is an issue but would be greater without vender support
Examplary
👍 1
Selected: D
Legacy Systems - Outdated computing software, hardware, or other technologies that have been largely superseded by newer and more efficient alternatives. Unsupported Systems - Hardware or software products that no longer receive official technical support, security updates, or patches from their respective vendors or developers. Just because something is legacy does not mean that it's no longer supported by the vendor. However, it does mean that it is likely using outdated technologies/protocols. I vote D.
NONS3c
👍 1
Selected: D
it is correct
17f9ef0
👍 1
Selected: D
Answer is D
Syl0
👍 1
hmmm, if it's security concern, shouldn't it be D use of insecure protocol?
Cee007
👍 3
Selected: D
The answer is D. Legacy systems rely on outdated protocols which often contain vulnerabilities that attackers can exploit. They may also lack the security features to protect against modern threats.
Ina22
👍 1
D. Use of insecure protocols. Legacy systems often rely on outdated protocols that may not have the necessary security features to protect against modern threats. This can lead to vulnerabilities that attackers can exploit, compromising the integrity, confidentiality, and availability of the system and its data.
jafyyy
👍 1
D Legacy systems rely on outdated and insecure protocols with known vulnerabilities.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Core Concept
Legacy systems, often classified as End-of-Life (EOL) or End-of-Support (EOS), continue to operate in production environments despite being superseded by modern alternatives. While they may still function operationally, their continued use introduces severe security liabilities that must be evaluated through a risk-based lens.Why Option B is Correct
Lack of vendor support is the most critical security concern because it eliminates the ability to receive security patches, firmware updates, or hotfixes for newly discovered vulnerabilities. As noted by multiple candidates, unsupported systems leave known exploits permanently active, forcing organizations to rely entirely on compensating controls. Without a vendor to validate fixes or provide guidance, any breach or zero-day discovery remains unaddressed indefinitely.Why Other Options Are Incorrect
- Instability (A) refers to operational reliability and performance degradation, which impacts business continuity but is not primarily a direct security threat.
- Loss of availability (C) is a potential outcome of a successful attack or system failure, but it is a consequence rather than the root security concern itself.
- Use of insecure protocols (D) is a valid technical flaw, but candidates often overestimate its severity compared to patch dependency. As highlighted in the community discussion (comment #10), insecure protocols can frequently be mitigated through network-layer compensating controls such as firewalls, VLAN segmentation, or encrypted tunnels. However, these workarounds do not fix underlying operating system or application vulnerabilities caused by discontinued vendor support.
Exam Context
CompTIA Security+ heavily emphasizes risk management and mitigation techniques. When legacy systems cannot be replaced immediately, certification frameworks prioritize identifying the factor that prevents remediation. Recognizing that patching capability outweighs specific protocol weaknesses aligns with industry best practices and exam logic.Official Reference
Exam Strategy
When evaluating security risks for legacy or unsupported systems, always look for the root cause that prevents remediation. If an option addresses the inability to apply patches or receive security updates, it typically outweighs specific technical flaws that might be mitigated through compensating controls like firewalls or encryption.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →