Examkin

Question

Difficulty: MediumSecurity Control Categories and Types

Following a compliance audit, an enterprise identifies a legacy core mainframe application that cannot natively support multi-factor authentication (MFA) or modern encryption protocols. To address the vulnerability without replacing the application, the security team deploys an isolated jump host requiring hardware token MFA and places an inline proxy in front of the mainframe to encrypt all transient sessions. Which of the following functional control types is best demonstrated by this implementation?

  1. Compensating controlAnswer
  2. B
    Corrective control
  3. C
    Deterrent control
  4. D
    Directive control

Answer

The implementation represents a compensating control because it provides an alternative technical mechanism to satisfy security requirements when native controls cannot be supported.
The selection of a compensating control is correct because placing a secondary gateway (MFA jump host and inline proxy) around a legacy system provides an alternative technical barrier that meets organizational authentication and encryption policy requirements when the primary host cannot support those features natively.

Step-by-Step Solution

1
Analyze the operational limitation presented in the scenario.
The core legacy mainframe system lacks native support for required security controls (MFA and session encryption).
Identifying the inability to deploy standard primary controls establishes the need for an alternate security measure.
2
Evaluate the mechanism chosen by the security team.
The team introduced an external MFA jump host and an inline encryption proxy to mitigate the exposure.
This alternative mechanism fulfills the security objective without directly altering the underlying legacy application.
3
Map the mechanism to CompTIA Security+ functional control types.
Controls designed to achieve the intent of a primary security requirement when primary controls are infeasible are classified as compensating controls.
Compensating controls specifically substitute for standard measures to achieve equivalent risk mitigation.

Key Concept

Security Control Functional Types: Compensating Controls
Rate this question

Topics

Security Control Categories and Types

More questions from this topic