SY0-701 General Security Concepts Practice Question
Exhibit
Legacy system constraints - Controller cannot support MFA - Controller cannot support modern encryption - Replacement will not occur for 9 months Compensating measures implemented - Dedicated management VLAN - Firewall ACLs limiting source IPs - Jump host with session recording - Daily configuration backups
Based on the exhibit, what best describes the additional measures applied to the legacy system?
⚠ Common exam trap
CompTIA often tests the distinction between compensating controls and preventive controls by describing a scenario where the ideal control is impossible, and candidates mistakenly choose 'preventive' because the compensating control still blocks some attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compensating controls, because they reduce risk when the preferred security controls are not possible.
The exhibit shows a legacy system that cannot support modern authentication protocols like Kerberos or NTLMv2. The additional measures—such as network segmentation, strict firewall rules, and an application-layer gateway—are compensating controls. They reduce risk by enforcing security in the network layer since the preferred control (upgrading the OS or application to support strong authentication) is not feasible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Preventive controls, because they stop every possible compromise completely.
Why it's wrong here
The measures do reduce risk, but they do not eliminate all compromise paths and are not being used in the normal ideal way. The important clue is that the primary security requirements cannot be met on the device itself, so alternate controls are used instead.
- ✓
Compensating controls, because they reduce risk when the preferred security controls are not possible.
Why this is correct
Compensating controls are the best description because the system cannot support MFA or modern encryption, yet the organization still needs to reduce risk until replacement. The VLAN, ACLs, jump host, and session recording provide alternate safeguards that help offset the missing native controls.
- ✗
Corrective controls, because they repair the controller after an incident occurs.
Why it's wrong here
Corrective controls address damage after a security event or restore systems to a secure state. The exhibit describes measures already put in place before an incident to reduce exposure. That makes them compensating, not corrective, controls.
- ✗
Deterrent controls, because they mainly scare attackers away from trying.
Why it's wrong here
Deterrent controls discourage attacks, such as visible signage or warning banners. The exhibit contains concrete technical and procedural restrictions that limit access and increase visibility. Those measures do more than discourage; they compensate for missing native protections.
Go deeper
Related to this question
Learn chapter
Security Controls
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Network segmentation
Network segmentation is the practice of dividing a computer network into smaller, isolated parts to improve performance, contain security threats, and simplify management.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.