Exam CISA topic 1 question 737 discussion

Actual exam question from Isaca's CISA

Question #: 737
Topic #: 1

An IS auditor has discovered that a software system still in regular use is years out of date and no longer supported. The auditee has stated that it will take six months until the software is running on the current version. Which of the following is the BEST way to reduce the immediate risk associated with using an unsupported version of the software?

A. Verify all patches have been applied to the software system's outdated version.
B. Monitor network traffic attempting to reach the outdated software system.
C. Close all unused ports on the outdated software system.
D. Segregate the outdated software system from the main network.

Show Suggested Answer

Suggested Answer: D 🗳️

by MunaM at Sept. 7, 2022, 10:54 p.m.

Comments

Submit Cancel

MunaM

Highly Voted 2 years, 11 months ago

I think answer should be D

upvoted 7 times

...

Jag127

Highly Voted 2 years, 5 months ago

Selected Answer: D

Yes it should be D as keeping the system out of main network will protect the network from any vulnerability exposure

upvoted 6 times

...

maxson69

Most Recent 1 month, 3 weeks ago

Selected Answer: D

Segregate the outdated software system from the main network because it's the most effective immediate control to mitigate exposure when updates are not yet feasible.

upvoted 1 times

...

Swallows

1 year ago

Selected Answer: A

Older versions of software are no longer supported and may not be patched for new security vulnerabilities, so patching known vulnerabilities whenever possible helps minimize the risk of an attack.

upvoted 1 times

...

Eiad1100

1 year, 2 months ago

Selected Answer: D

D is the best immediate action to reduce the associated risk

upvoted 3 times

...

Sayed_Jawad

1 year, 5 months ago

Selected Answer: D

It should be D, the question is asking "to reduce", asking for mitigation. Monitoring is not a control. Monitoring and reviewing is a detective control

upvoted 4 times

...

Lusis

1 year, 10 months ago

I think the answer still should be B, because of the fact that "it will take six months until the software is running on current version". if it means in 6 months the version will be changed and be supported, doesn't make sense to segregate, but monitor.

upvoted 2 times