Study. uk . com
  1. Home
  2. All questions
  3. Question 117

CompTIA Security+ study material · question 117 of 611

A legacy control system cannot be patched and cannot be replaced this year. What does NIST expect the organisation to produce for it?

  1. Its own maintenance plan built from compensating controls
  2. A documented exception with no further action
  3. A vendor attestation of safety
  4. A revised CVSS score for the asset
Show the answer

Answer: A. Its own maintenance plan built from compensating controls

An unpatchable asset will never reach the state the standard plan assumes, so it needs a plan of its own.

Source: NIST SP 800-40 Rev. 4 (NIST) — SP 800-40 Rev. 4 § 3.5.4 Maintenance Plans for Unpatchable Assets

Challenge yourself on this topic → Study as cards