What control type is segmenting a legacy server into a private network?
Compare and contrast various types of security controls.
Given a scenario, select mitigation techniques or controls to secure an enterprise environment.
Which of the following security controls is most likely being used when a critical legacy server is segmented into a private network?
Answer
Correct answer: C — Segmenting the critical legacy server into a private network is a compensating control because patching or upgrading the host is not feasible.
Community Votes
59% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
It tests CompTIA's control-type taxonomy, where the word "legacy" signals a compensating control — and the trap is choosing Preventive (D) simply because segmentation restricts access.
This SY0-701 item asks you to classify network segmentation of a critical legacy server by security-control type. The answer is Compensating (C), because isolating the host substitutes for the patching and hardening the legacy server cannot support.
The most common wrong answer is D. Preventive (41 votes), because segmentation blocks unauthorized access before it happens. That describes the control's function, but an un-patchable legacy host turns segmentation into an alternative mitigation, which is a compensating control.
Community Discussion (18 comments)
RoRoRoYourBoat
👍 8
Selected: C
C, compensating.
EngAbood
👍 2
Selected: D
Chatgpt said D. Preventive : ( , and when ever i see legacy i chose compensating :(
fc040c7
👍 3
Selected: C
there have been multiple questions with legacy items being compensated for with segmentation. this is no different. I am going with C.
esko636
👍 1
Selected: C
Compensating controls provide alternative measures to mitigate risk when the primary control is not feasible. If the legacy server cannot be patched or upgraded, segmenting it into a private network acts as a compensating control by restricting access and reducing the risk posed by its vulnerabilities.
d06e2b4
👍 4
Selected: C
Segmentation of a critical legacy server into a private network is a compensating control because it addresses security risks when the legacy system cannot be updated or secured using standard measures, like patches or modern preventive controls.
5787808
👍 2
Selected: D
D. Preventive
viktorrdlyi
👍 3
Selected: D
Preventive because we aint compensating anything!! Nothing mentioned In the question to compensate!
fmeox567
👍 1
Selected: D
D. Preventive Preventive controls are designed to stop or mitigate unwanted actions or events before they happen. By segmenting a critical legacy server into a private network, the organization is aiming to prevent unauthorized access and potential threats, thus isolating the server from the broader network and reducing the risk of compromise.
famuza77
👍 1
C, Compensating
BluezClues
👍 1
Selected: C
The correct answer is C. Compensating. When a critical legacy server is segmented into a private network, the security control being used is likely compensating. This is because the legacy server may not support modern security features, and network segmentation is implemented as a workaround to mitigate risks and protect it from external threats. A compensating control is used to achieve a level of security equivalent to the one required when it is not possible to implement the primary control. The other options: - A. Deterrent is designed to discourage malicious actions, such as warning signs or legal warnings. - B. Corrective is aimed at fixing issues after an incident has occurred. - D. Preventive is used to stop attacks from happening in the first place, but in this case, segmentation is compensating for the server's inherent vulnerabilities. Thus, network segmentation is a "compensating" control.
goku5786
👍 1
Selected: D
D. Preventive
nillie
👍 1
Selected: C
The most likely security control being used when a critical legacy server is segmented into a private network is: C. Compensating A compensating control is implemented when the primary control (such as patching or updating a legacy server) is not feasible. Segmenting the legacy server into a private network is a compensating control because it mitigates risk by limiting the server's exposure without requiring changes to the server itself, which might not be possible due to its legacy status.
a0bfa81
👍 1
Selected: D
Segmenting a critical legacy server into a private network is a preventive security control. It helps to protect the server from unauthorized access and potential attacks by isolating it from the rest of the network, thereby reducing the risk of security breaches. Preventive controls are designed to stop security incidents before they occur.
jsmthy
👍 1
Selected: C
compensating, because the best preventative action is to remove the server altogether. You are mitigating the risk by segmenting a vulnerable legacy server.
chasingsummer
👍 1
Selected: D
D. Preventive
koala_lay
👍 1
Selected: D
Agree to D. Preventive Segmenting a critical legacy server into a private network is a preventive measure designed to reduce the risk of unauthorized access and protect sensitive data by controlling traffic to and from the server.
Glacier88
👍 1
Selected: D
Preventive controls: These controls are designed to prevent security incidents from occurring in the first place. By segmenting the critical legacy server into a private network, the organization is taking steps to prevent unauthorized access or attacks on that system. Compensating controls: Compensating controls are used to mitigate the risks associated with other security controls that are not in place or are ineffective. While segmentation could be considered a compensating control in some cases, it's primarily a preventive control in this scenario.
BugG5
👍 1
D - preventive. Segmentation of a critical legacy server into a private network is primarily aimed at preventing unauthorized access and ensuring the server’s security. This control falls under the category of Preventive Controls, as its primary goal is to prevent an incident from occurring. Preventive controls, attempt to prevent an incident from occurring by restricting access, implementing barriers, or enforcing policies. In this case, segmenting the critical legacy server into a private network serves as a preventive measure to restrict access and prevent potential security breaches.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The decisive detail is "critical legacy server": patching, OS upgrades, and hardening — the normal primary controls — are not feasible, so the organization places the host in a private network as an alternative mitigation. That is the textbook definition of a compensating control in CompTIA's SY0-701 control-type taxonomy. Segmentation does have a preventive effect (it restricts traffic), but the control's role in this scenario is to compensate for an asset that cannot be remediated. It neither repairs the host after a compromise nor discourages an attacker, which separates it from corrective and deterrent types.Why the Other Options Are Wrong
A. Deterrent — deterrent controls such as banners, signage, and warning messages discourage would-be attackers; moving a server to a private network is not designed to deter anyone. B. Corrective — corrective controls such as backups, restore, reimaging, or patching bring a system back to a known-good state after an event, and segmentation fixes nothing on the legacy host. D. Preventive — the strongest distractor: segmentation genuinely blocks unauthorized access before it occurs, and for a fully supported server it would be classified as preventive. Here it is a substitute for controls that cannot be applied to a legacy host, so the "most likely" label points to compensating rather than preventive.Community Comment Notes
Commenters split C (59 votes) versus D (41). d06e2b4 argued the legacy system "cannot be updated or secured using standard measures, like patches or modern preventive controls," which matches the compensating-control definition, and fc040c7 recalled repeated SY0-701 items where legacy assets are handled with segmentation. viktorrdlyi voted D insisting "we aint compensating anything!! Nothing mentioned In the question to compensate!" — a fair functional reading, but the word "legacy" is the compensating trigger. EngAbood admitted picking D under ChatGPT's influence while noting "whenever i see legacy i chose compensating," and jsmthy added that "the best preventative action is to remove the server altogether," meaning segmentation only mitigates residual risk.Official Reference
Exam Strategy
When a scenario mentions a legacy or unpatchable system plus an alternative safeguard, default to compensating control; reserve preventive for controls applied as the primary, planned defense for a supported asset. Read the qualifier "most likely" as a signal to weigh why the control was selected, not just what it technically does.
Frequently Asked Questions
Why is private-network segmentation a compensating control instead of a preventive one?
It does block access, but CompTIA treats it as compensating because the legacy server cannot be patched or upgraded, so segmentation substitutes for the primary controls that are not feasible.
When would segmenting a server be classified as a preventive control?
When it is the planned, primary defense for a supported system — for example, normal network zoning — rather than a workaround for an un-patchable legacy host.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →