Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
CompTIA Security+ · CompTIA
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The key word here is "first" that is why it is 100% Mitigate. Otherwise, one could argue if could also be accepted.
Since the legacy application is critical to business operations and lacks preventative controls, the most logical first step is to reduce (mitigate) the risk by implementing those missing controls. This approach proactively addresses vulnerabilities before they can be exploited. Let’s evaluate the other options: B. Accept – This would mean tolerating the risk without taking action, which is not ideal for a critical system with unaddressed controls. C. Transfer – This involves shifting risk (e.g., via insurance or outsourcing), but it doesn’t directly improve the security of the application itself. D. Avoid – This would mean discontinuing use of the application, which is not feasible if it’s critical to operations.
Mitigate 1st since it is a legacy application and is critical