Question 64

Preventive security controls are being used when a critical legacy server is segmented into a private network.

Segmenting a critical legacy server into a private network is a preventive measure aimed at reducing the risk of unauthorized access and potential vulnerabilities. This type of control is designed to proactively mitigate risks before they can lead to security incidents.

A) Deterrent

Deterrent controls are designed to discourage potential attackers from attempting unauthorized actions, typically through warnings or visible security measures. While segmentation may indirectly deter some attacks, its primary function is not deterrence but rather to prevent access to the server.

B) Corrective

Corrective controls are implemented after an incident has occurred to restore systems and processes to normal operation. Segmentation does not fall into this category, as it is aimed at preventing incidents from happening in the first place rather than addressing them after they occur.

C) Compensating

Compensating controls are alternative measures put in place to satisfy security requirements when the primary control cannot be implemented. In this case, segmentation serves as a primary control to prevent access rather than a compensating measure, making this option incorrect.

D) Preventive

Preventive controls are explicitly designed to avert potential security incidents before they occur. Segmenting a legacy server into a private network effectively restricts access and minimizes exposure to threats, reinforcing its classification as a preventive control.

Conclusion

The segmentation of a critical legacy server into a private network is a classic example of a preventive security control, as it aims to mitigate risks before they can escalate into security breaches. Other options, such as deterrent, corrective, and compensating controls, do not directly address the proactive nature of network segmentation, thus failing to meet the question's criteria.