SY0-701 General Security Concepts Practice Question
A legacy reporting application cannot be modified this quarter, but users still need access from the corporate network. Security adds a hardened jump server, tighter monitoring, and manual approval for each session because MFA cannot be built into the app yet. What type of control is this?
⚠ Common exam trap
Many candidates confuse compensating controls with detective controls because monitoring is involved, but the primary purpose of compensating controls is to provide an alternative security function, not just to detect events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compensating control
A compensating control is an alternative security measure implemented when the primary control cannot be applied due to technical or operational constraints. In this scenario, the legacy application cannot be modified to support MFA, so the organization deploys a hardened jump server, enhanced monitoring, and manual session approval as compensating controls to reduce risk. These controls do not eliminate the vulnerability but provide an equivalent level of protection until the application can be updated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Compensating control
Why this is correct
A compensating control is an alternative safeguard that provides equivalent risk reduction when the preferred security control cannot be implemented due to technical or operational constraints. In this case, the legacy application cannot be modified to support MFA, so the organization deploys alternate measures—such as network segmentation, IP allowlisting, or out-of-band verification—to satisfy the security objective and maintain an acceptable risk posture.
- ✗
Detective control
Why it's wrong here
A detective control is designed to identify and record security events after they have occurred, using mechanisms like log review, intrusion detection, or audit trails. While monitoring is often a detective component, the overall measure here functions as an active substitute for MFA by enforcing or reviewing access decisions, not merely reporting violations, so it cannot be classified solely as detective.
- ✗
Corrective control
Why it's wrong here
A corrective control acts after a security incident to remediate damage and restore normal operations, such as applying a patch, restoring from backup, or executing an incident response plan. These controls do not provide the access enforcement that MFA would have given; they are not a substitute for an unavailable preventive control, and implementing them does not address the missing authentication requirement.
- ✗
Deterrent control
Why it's wrong here
A deterrent control seeks to discourage potential attackers by creating a perception of risk or consequence, such as warning banners, employee disciplinary policies, or physical security measures. These controls do not provide an alternate mechanism for verifying identity or authorization, so they would not replace the security capability that MFA was intended to supply.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.