The best answer is C. Isolate the outdated software system from the main network.
If software is unsupported, immediate risk reduction should focus on containment because new vulnerabilities may not be fixable through vendor patches. ISACA guidance notes that unsupported software should be identified as unsupported, and isolation is a standard risk-reduction approach when a vulnerable or high-risk system must remain in use temporarily. ISACA material on secure isolated environments also supports isolation as a strong protection method against threats from the rest of the environment.
Option A helps only if patches exist, but unsupported software often no longer receives patches. Option B protects data in transit, not the system's exposure to exploitation. Option D is a useful hardening step, but it is narrower and less protective than network isolation. Therefore, isolation is the best immediate control to reduce exposure while a longer-term replacement or remediation plan is developed.
References (Official ISACA):
* ISACA, How to Construct a Governance System From the Board Level to the Code Level.
* ISACA White Paper, Exploring Practical Considerations and Applications for Privacy-Enhancing Technologies.