CompTIA Security+ (SY0-701)General Security ConceptsEasy
A hospital's radiology system runs on an operating system that can no longer be patched due to vendor support constraints. To reduce risk while keeping the system operational, the security team places it on an isolated VLAN with strict firewall rules and enhanced monitoring. What type of control is this VLAN isolation an example of?
- ACorrective control
- BCompensating control
- CDeterrent control
- DPreventive control
Show answer & explanationAnswer & explanation
Correct answer: B. Compensating control
A compensating control is an alternative safeguard used when the primary control (patching) cannot be applied, reducing risk through other means like isolation and monitoring.
Why the other options are wrong
- A. Corrective controls fix damage after an incident has occurred.
- C. Deterrent controls discourage attackers through psychological means, not technical isolation.
- D. Preventive controls stop an incident before it occurs, but this is a workaround, not the original prevention mechanism.
Compensating Control
An alternative control implemented when the primary control is not feasible, providing similar risk reduction.
- Used when patching or standard fixes are unavailable
- Common in legacy or unsupported systems
- Examples: network segmentation, added monitoring, restricted access
Memory trick: Can't patch it? Compensate around it.