Which statement best describes handling legacy security technologies?

• A. Replace immediately
• B. Replace only when necessary
• C. Never replace
• D. Replace during quarterly cycles

Answer: (B)

Managing legacy security technologies works best when you replace them based on risk signals and practical impact, not on a fixed timetable. Replacing only when necessary lets you balance security with cost, compatibility, and uptime. You keep monitoring for signs like end-of-life or end-of-support from vendors, unpatched vulnerabilities, degraded performance, or integration problems with newer controls. When those risks become significant, you upgrade or retire the legacy tool and implement a migration plan, using compensating controls in the meantime such as tighter network segmentation, stricter access controls, enhanced monitoring, and regular audits to reduce exposure. Immediate replacement can be wasteful and disruptive, and never replacing leaves persistent vulnerabilities; a rigid quarterly cycle may miss urgent threats or waste resources.