mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: Is implementing a defense-in-depth strategy for…
An organization is implementing a defense-in-depth strategy for its web application. Which of the following is an example of a compensating control?
⚠ Common exam trap
Watch out — candidates often confuse compensating controls with preventive or detective controls, mistakenly selecting a direct security measure like a firewall or two-factor authentication as compensating, when in fact a compensating control is specifically an alternative measure used because the primary control cannot be implemented.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A web application firewall (WAF) blocking SQL injection
A compensating control is an alternative security measure implemented when a primary control cannot be applied due to technical or business constraints. In this context, a Web Application Firewall (WAF) blocking SQL injection serves as a compensating control when, for example, source code fixes for input validation are not immediately feasible. The WAF inspects HTTP/HTTPS traffic at the application layer (Layer 7) and uses signature-based or behavioral analysis to detect and block malicious SQL patterns, thereby mitigating the vulnerability without modifying the application code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A firewall blocking port 80
Why it's wrong here
Blocking port 80 with a firewall is a preventive network access control. While it prevents direct HTTP communication, it does not compensate for an *existing* internal application vulnerability or design flaw. Instead, it directly denies a specific type of traffic, which is a primary control, not a secondary or compensating measure for a deficiency within an application itself.
- ✗
Regular vulnerability scanning
Why it's wrong here
Regular vulnerability scanning is a detective control designed to identify security weaknesses and misconfigurations within systems and applications. While crucial for a robust security posture, it does not actively compensate for or mitigate an *already known* or *exploitable* flaw in real-time. Its primary function is discovery, not remediation or compensating for a deficiency.
- ✓
A web application firewall (WAF) blocking SQL injection
Why this is correct
A Web Application Firewall (WAF) blocking SQL injection is an excellent example of a compensating control. It provides an external layer of protection by inspecting HTTP/S traffic and filtering malicious input, thereby mitigating common web application vulnerabilities like SQL injection, even if the underlying application code has deficiencies in input validation or secure coding practices. This external control compensates for internal application weaknesses.
- ✗
Two-factor authentication for administrative access
Why it's wrong here
Two-factor authentication (2FA) for administrative access is a strong preventive and access control measure that significantly enhances identity verification and reduces the risk of unauthorized access due to compromised credentials. However, 2FA primarily addresses authentication strength and does not compensate for or mitigate specific application-layer vulnerabilities, such as insecure coding practices or design flaws within an application itself.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Compensating control
A compensating control is a security measure implemented to reduce risk when a primary control cannot be used or is insufficient.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.