ISC2 CISSP Practice Question

The correct answer is replacing the software with a supported alternative. End-of-life software that no longer receives security updates represents an increasing security risk over time as new vulnerabilities are discovered but not patched. Replacing it with supported software is the most comprehensive solution that addresses the root cause of the risk.

Continuing to use the software without changes is the highest-risk option, as the software will become increasingly vulnerable over time with no way to address new security issues.

Implementing additional security controls to isolate and protect the vulnerable software can be a temporary mitigation but is generally less effective than replacement. These controls may be complex, costly, and still leave residual risk, especially for direct attacks against the vulnerable software.

Hiring developers to create custom patches for the software is typically impractical, expensive, and risky. Without access to the original source code and design documentation, custom patches may introduce new vulnerabilities or cause compatibility problems.