Because the system is mission critical and there is no patch and no vendor support, the best risk-reduction approach is to implement compensating controls. Compensating controls are specifically recommended when immediate remediation is not possible, and for legacy systems where patches may not exist.

The Sybex CySA+ Study Guide states this directly:

Exact extract (Sybex Study Guide): “Legacy systems may not have patches available, meaning that compensating controls may be the only option available.”

Secbay Press also explains that legacy systems may lack vendor support/updates and that mitigation strategies like compensating controls or isolation are essential to reduce risk:

Exact extract (Secbay Press): “Legacy systems may lack vendor support and updates, making mitigation strategies essential… Implement specific mitigation strategies for legacy systems, such as compensating controls or isolation.”

And Secbay provides a legacy-system compensating control case study showing exactly the kinds of controls mentioned in option D—segmentation/isolation, access controls, and enhanced monitoring/continuous monitoring:

Exact extract (Secbay Press): “Selected compensating controls, such as network segmentation, intrusion detection systems, and enhanced monitoring, to mitigate the risks…”

Why the other options are not “best” given the constraints:

A (Decommission immediately): may be ideal long-term, but conflicts with “mission critical” (and “immediately” is often unrealistic for business operations).

B (Block inbound/allow outbound): helps somewhat but is incomplete and can still allow command-and-control or exfiltration outbound; also doesn’t address restricted admin access/monitoring comprehensively.

C (WAF): useful only if this is specifically a web application exposure; the scenario says “legacy system” broadly. Compensating controls are the most complete and universally applicable choice.

References (CompTIA CySA+ CS0-003 documents / study guides used):

Chapple/Seidl, CompTIA CySA+ Study Guide (CS0-003): legacy systems may have no patches; compensating controls may be the only option

Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): legacy systems lack support/updates; use compensating controls or isolation

Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): compensating controls for legacy systems include segmentation/isolation and enhanced/continuous monitoring