Which of the following is a compensating control for providing user access to a high-risk website?

Question

Options

• AEnabling threat prevention features on the firewall
• BConfiguring a SIEM tool to capture all web traffic
• CSetting firewall rules to allow traffic from any port to that destination
• DBlocking that website on the endpoint protection software

• A
  72% (28)
• B
  18% (7)
• C
  8% (3)
• D
  3% (1)

Explanation

Option A is correct because a compensating control mitigates risk while still permitting the action - it doesn't block access, it reduces the danger of that access. Enabling threat prevention features (IPS, malware inspection, SSL decryption) on the firewall actively scans and blocks malicious content in real time as users access the high-risk site, directly offsetting the elevated risk.

Option B is wrong because a SIEM is a detective control - it logs and alerts after the fact but does nothing to prevent harm while the user browses the risky site.

Option C is wrong because opening all ports to that destination increases risk rather than compensating for it; it removes port-level restrictions that were previously limiting exposure.

Option D is wrong because blocking the site entirely is a preventive control that eliminates access - a compensating control assumes the access is still granted, just made safer.

Memory tip: Think "compensate, don't eliminate." A compensating control keeps the door open but puts a security guard at it. Threat prevention on the firewall = the guard inspecting everyone who walks through; blocking the site = locking the door entirely (no longer compensating, just preventing).

No community discussion yet for this question.