A legacy manufacturing control system cannot support multifactor authentication. The security team places it on an isolated VLAN reachable only through a hardened jump host that does enforce MFA. Which control type does this arrangement represent?
Select an answer to reveal the explanation.
Short Explanation
When you can't put a deadbolt on an old door, you put the whole room behind one that does lock. That's a compensating control. The trap is calling it corrective, but nothing on the legacy box itself got fixed.
Full Explanation
A compensating control is an alternative safeguard used when the preferred control cannot be applied, delivering comparable risk reduction by other means. The legacy system cannot perform MFA, so the team surrounds it with segmentation and a jump host that enforces MFA; anyone reaching the system must first pass strong authentication elsewhere. Corrective controls restore systems or remediate the effects of an incident after it happens, such as restoring from backup or reimaging a host; here the legacy system's authentication remains exactly as weak as before, and no incident is being remediated. Deterring controls discourage attempts through warnings or visible consequences; network isolation does not rely on influencing attacker behavior, it removes reachable paths. Directive controls instruct people what to do, typically through policy or procedures; although operators will be told to use the jump host, the protection comes from the enforced network design, not from the instruction. Exam caveat: compensating controls appear frequently with legacy systems, unsupported devices, and regulatory requirements that cannot be met directly, and they should be documented as exceptions with an owner and review date. Operational check: verify that firewall rules allow traffic to the legacy VLAN only from the jump host, confirm MFA is required for every jump host session, and review jump host logs for direct connection attempts that bypass it.