A vulnerability analyst runs a credentialed vulnerability scan covering all addressable enterprise assets.

Legacy and proprietary systems, unavailable patches, and vendor dependencies are classic technical and operational inhibitors to immediate vulnerability remediation. A legacy application may require obsolete libraries or operating systems that cannot accept modern updates. Proprietary platforms may permit changes only through an approved manufacturer or integrator, while certain vulnerabilities simply have no patch available when they are initially disclosed.

CISA guidance emphasizes continuously monitoring vendor vulnerability and patch announcements because remediation frequently depends on vendor-provided updates. CISA and NIST guidance also recognizes that systems remaining in service after vendor support ends create significant vulnerability-management challenges because patches may no longer be produced.

Option A is weakened by “absence of an asset inventory” because the scenario states that the credentialed scan already covers all addressable enterprise assets; inventory quality can affect management, but it does not best explain why identified critical findings cannot be patched. Options B and C contain possible administrative difficulties, yet they are less directly tied to widespread remediation constraints.

When immediate remediation is impossible, analysts should document the exception, assess risk, apply compensating controls where feasible, monitor affected systems, and establish a migration or vendor-remediation plan.

Study Guide Reference: Vulnerability Management → Remediation Constraints → Legacy/Proprietary Systems → Patch Availability → Vendor Dependencies → Compensating Controls → Risk Acceptance/Exception Management.