Questions: Question 87 Not Answered QUESTION A security analyst has identified a compromised system on the network and needs to prevent further damage. The analyst has decided to implement controls to limit the potential damage. Which of the following is an example of a compensating control that the analyst could implement to prevent further damage? ANSWER Disabling the compromised system's network adapter Deleting system files Physically removing the compromised system from the network Shutting down the network Time left: 53:59

The answer is the first one: Disabling the compromised system's network adapter.

Explanation for each option:

1. Disabling the compromised system's network adapter: This is a compensating control because it isolates the compromised system from the network, preventing it from communicating with other systems and potentially spreading the compromise. It limits the damage while allowing the system to remain powered on for further analysis and remediation.

2. Deleting system files: This is not a compensating control. Deleting system files could cause further damage to the system and may result in data loss or system instability. It does not prevent the system from causing further damage to the network.

3. Physically removing the compromised system from the network: While this action does prevent further damage, it is more of a corrective control rather than a compensating control. It involves physically disconnecting the system, which may not be as immediate or practical as disabling the network adapter.

4. Shutting down the network: This is not a compensating control. Shutting down the entire network is a drastic measure that affects all systems and users, not just the compromised one. It is not a targeted approach and can cause significant disruption to business operations.

In summary, disabling the compromised system's network adapter is the most appropriate compensating control to prevent further damage while maintaining the ability to analyze and remediate the system.