Securing End-of-Life Systems with Network Isolation
A systems administrator notices that one of the systems critical for processing customer transactions is running an end-of-life operating system. Which of the following techniques would increase enterprise security?
Community Votes
61% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests balancing security against operational requirements; the trap is choosing decommissioning for maximum security while ignoring the 'critical' nature of the system.
When a critical system runs an unsupported OS, network segmentation via an isolated VLAN is the most effective mitigation to increase enterprise security without disrupting business continuity.
Many candidates choose Decommissioning (C) because it eliminates risk entirely, failing to account for the business impact on critical transactions.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Placing the system in an isolated VLAN (B) significantly increases enterprise security by limiting its attack surface. Since the operating system is end-of-life and cannot receive patches, it remains vulnerable to exploits. By isolating it, you prevent lateral movement from this compromised host to other parts of the network, effectively containing the threat while allowing the system to continue processing necessary transactions.Why the Other Options Are Wrong
Decommissioning (C) is the most secure option technically, but it is not feasible here because the system is 'critical for processing customer transactions,' implying immediate decommissioning would cause unacceptable business disruption. Installing HIDS (A) provides detection but not prevention, leaving the system exposed to exploitation. Encrypting the hard drive (D) protects data at rest but does nothing to mitigate network-based attacks or vulnerabilities inherent in the unpatched OS.Community Comment Notes
The community is split, with a majority favoring isolation. As user a4e15bd noted, "Give that the system is critical... decommissioning immediately might impact business continuity." Users like Migzz argue that B allows for "Isolate it until you're ready to make the relevant changes," whereas C users like ProudFather emphasize that "End-of-life systems... are highly vulnerable" and should be removed. The key differentiator is the word 'critical,' which forces a containment strategy rather than a removal strategy.Exam Strategy
Always read adjectives like 'critical' or 'essential' carefully; they often rule out solutions that involve shutting down or removing resources, pointing instead toward containment or mitigation strategies.
Frequently Asked Questions
Why not decommission a critical system running EOL OS?
Decommissioning removes the asset, but if it is 'critical' for operations, immediate shutdown causes business disruption. Containment is the required interim step.
Does HIDS protect against EOL OS vulnerabilities?
HIDS detects activity but does not prevent exploitation of known unpatched vulnerabilities. It is a detective control, not a sufficient preventive one for EOL systems.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →