Exam SY0-701 topic 1 question 426 discussion

In this scenario, the organization has no choice but to accept the risk associated with the unsupported system. The system is critical to the business, and it cannot be modified or replaced without disrupting operations. Therefore, the organization must implement additional security measures, such as regular vulnerability assessments and patching, to mitigate the risk as much as possible.

If transfer wasnt here I would go with accept, but transfer is getting insurance for something that you know will happen. then best solution would get the insurance, for something that you know will cause an issue.

The best answer is C - Transfer, an organization can purchase insurance to cove the cost of data loss or business interruption. No company can Accept a rick that is critical to it's operations.

Briefly the company just accepted risk and there is no other way.

In this scenario, the system is critical to the business, cannot be modified, and must stay online, but it is no longer receiving support from the vendor. The most appropriate risk treatment is to accept the risk, because the system's continued operation is essential to the business, and there is no practical way to eliminate or replace it. Accepting the risk means acknowledging the vulnerabilities or potential issues but deciding that the benefits of keeping the system running outweigh the risks. The organization may need to implement additional measures, such as enhanced monitoring, custom security controls, or risk mitigation strategies, to manage the risks associated with the unsupported system

In this scenario, the system is critical to the business, cannot be modified, and must stay online despite no longer receiving vendor support. Since replacing or updating the system is not an option, the most appropriate risk treatment is to accept the risk while implementing additional mitigating controls to reduce potential vulnerabilities.