nerdexam
(ISC)2

CISSP · Question #1151

What is considered a compensating control for not having electrical surge protectors installed?

The correct answer is B. Having backup diesel generators installed to the site. A compensating control substitutes for a missing primary control by mitigating the same risk through an alternative means. Without surge protectors, backup diesel generators compensate by providing a stable, regulated power source that bypasses utility grid fluctuations.

Submitted by salim_om· Mar 5, 2026Security and Risk Management

Question

What is considered a compensating control for not having electrical surge protectors installed?

Options

  • AHaving dual lines to network service providers built to the site
  • BHaving backup diesel generators installed to the site
  • CHaving a hot disaster recovery (DR) environment for the site
  • DHaving network equipment in active-active clusters at the site

How the community answered

(37 responses)
  • A
    5% (2)
  • B
    84% (31)
  • C
    8% (3)
  • D
    3% (1)

Why each option

A compensating control substitutes for a missing primary control by mitigating the same risk through an alternative means. Without surge protectors, backup diesel generators compensate by providing a stable, regulated power source that bypasses utility grid fluctuations.

AHaving dual lines to network service providers built to the site

Dual lines to network service providers address network redundancy and ISP failover, not electrical power quality or voltage surge risks to on-site equipment.

BHaving backup diesel generators installed to the siteCorrect

Backup diesel generators serve as a compensating control for missing surge protectors because they supply clean, independent power that is isolated from the utility grid where electrical surges originate. When generators are the power source, equipment is not exposed to the voltage spikes that surge protectors are designed to block. This directly addresses the same risk (power-related hardware damage) through an alternative power delivery mechanism.

CHaving a hot disaster recovery (DR) environment for the site

A hot DR environment compensates for site-wide availability loss after a disaster has already occurred, but it does not prevent hardware damage from electrical surges at the primary site.

DHaving network equipment in active-active clusters at the site

Active-active clustering provides high availability and load balancing for network services, but it does not mitigate the physical risk of electrical surges damaging the hardware nodes themselves.

Concept tested: Compensating controls for physical power protection

Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

Topics

#compensating controls#physical security#power redundancy#business continuity

Community Discussion

No community discussion yet for this question.

Full CISSP Practice