What Is the First Risk Management Strategy for a Critical Legacy Application?

SY0-701 By islever Editorial Last updated

Short answer

A Mitigate

Question

Which of the following risk management strategies should an enterprise adopt first if a legacy application is critical to business operations and there are preventative controls that are not yet implemented?
  1. Mitigate Correct Answer
  2. Accept
  3. Transfer
  4. Avoid

Key Takeaways

This question tests whether you recognize that critical business applications require risk reduction through implemented controls, making mitigation the appropriate first step over accepting, transferring, or avoiding.

For a legacy application critical to operations with missing preventative controls, the first risk management strategy should be mitigation, as it reduces risk to an acceptable level without disrupting business. Community consensus supports this view, with all votes selecting 'Mitigate'.

Common mistake: Choosing 'Accept' is the most common mistake, as some may think critical systems have inherent risks that must be accepted, but missing preventative controls mean the risk is too high to accept without action.

Expert Analysis

Why the Answer Is Correct

Mitigation is the correct first strategy because the legacy application is critical to business operations, meaning you cannot simply avoid it, and missing preventative controls mean the current risk is unacceptable. Mitigation involves implementing safeguards such as patching, adding compensating controls, or enhancing monitoring to reduce the risk to a manageable level. As noted in a comment, 'Mitigation would involve applying these controls to enhance security and reduce risk exposure.' Thus, mitigation is the immediate, proactive response.

Why the Other Options Are Wrong

'Accept' is wrong because accepting the risk without implementing any controls is only appropriate when the risk is low or when the cost of mitigation exceeds the potential impact, which is not the case here. 'Transfer' is wrong because cyber risk transfer (e.g., insurance) does not reduce the likelihood of an exploit, and it is not the first step when controls are missing. 'Avoid' is wrong because avoiding the risk would mean eliminating the application entirely, which is impossible given its criticality to business operations.

Community Comment Notes

Commenters consistently selected 'Mitigate' with a common rationale: the critical nature of the application demands risk reduction. One commenter said, 'Mitigate 1st since it is a legacy application and is critical,' while another highlighted that mitigation includes 'patching vulnerabilities, applying compensating controls.' None of the comments support other options, indicating strong consensus that mitigation is the textbook answer for this scenario.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Remember the four risk response strategies: mitigate, accept, transfer, avoid. When a business-critical asset has missing controls, mitigation is the automatic first choice because it actively reduces risk. Watch for keywords like 'critical' and 'not yet implemented'—they signal that the risk must be reduced, not accepted, transferred, or avoided.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Etc_Shadow28000 👍 13 Answered A
    A. Mitigate When a legacy application is critical to business operations and there are preventative controls that are not yet implemented, the first risk management strategy an enterprise should adopt is to mitigate the risks. This involves implementing measures to reduce the risk to an acceptable level. Mitigation can include steps such as patching vulnerabilities, applying compensating controls, segmenting the network, and hardening the application and its environment. Therefore, the correct answer is: A. Mitigate
  2. dbrowndiver 👍 3 Answered A
    Critical Legacy Application: The application is crucial for business operations, so removing it (avoiding) or accepting the risk without any action could have severe implications. Preventative Controls Needed: Since preventative controls are not yet implemented, mitigation would involve applying these controls to enhance security and reduce risk exposure. This why it is the best choice: Mitigation is the most appropriate strategy for addressing risks associated with critical applications, especially when controls can be applied to minimize potential threats.
  3. Syl0 👍 2 Answered A
    Mitigate 1st since it is a legacy application and is critical
  4. Shaman73 👍 3
    A. Mitigate

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide