A transit agency cannot yet replace an end-of-life ticket kiosk operating system, so it isolates the kiosk VLAN and adds extra monitoring. Which control type best describes those alternate safeguards?

Compensating controls provide alternate or additional safeguards when a preferred primary control cannot yet be implemented because of cost, legacy constraints, vendor timelines, or similar limits. A transit agency that cannot immediately replace an end-of-life ticket-kiosk operating system, and instead isolates the kiosk VLAN while adding extra monitoring, is applying compensating controls: segmentation and heightened detection reduce exposure until the preferred upgrade or replacement is feasible.

Calling the isolation directive because a council speech "required" it confuses authoritative mandates with the type of safeguard deployed. Directive controls prescribe required behavior through policy or instruction; VLAN isolation and monitoring are technical/operational mitigations used as substitutes, which is the compensating pattern. Labeling them corrective because isolation "undoes ransomware that already ran" is wrong when no such incident is described—corrective remediates after harm. Framing VLANs as physical because they are "facility locks" misuses the physical category; VLANs are logical network controls, not bodily facility barriers.

Exam caveat: compensating does not mean residual risk is zero. SY0-701 expects you to recognize alternate mitigations for gaps while still planning the preferred control. Do not assume compensating equals permanent acceptance without review.

Operational check: document the kiosk exception with owner, residual risk, compensating measures (segment, monitor, restrict egress, harden accounts), and a dated plan to retire the EOL OS. Revisit the exception in change and risk committees so temporary municipal workarounds do not become forgotten production norms.