CompTIA Security+ SY0-701 · Free study guide

Objective 2.5 — Choose mitigations that reduce enterprise risk

Mitigation should break the attack path or reduce impact while preserving required operations. The best control is tied to a demonstrated risk, assigned to an owner, validated after deployment, and monitored for drift.

Segmentation limits which systems can communicate. Isolation is stronger separation, often used for compromised or exceptionally sensitive workloads. Neither helps if broad identity permissions provide another path. Combine network boundaries with least privilege, strong authentication, and resource-level authorization.

Access control should grant only required actions for the required time. Application allow listing restricts execution to approved software and can stop unknown binaries, but it needs controlled update and exception processes. Configuration enforcement compares systems with approved baselines and corrects or reports drift.

Hardening as a system

Hardening includes changing default passwords, removing unnecessary software, disabling unused ports and protocols, applying updates, enabling encryption, configuring a host firewall, and deploying endpoint protection or a host intrusion-prevention system. A checklist is a starting point; the actual baseline must fit the workload and be tested.

Patching removes known vulnerable code, but emergency deployment can create outages. Prioritize by exploitability, exposure, asset criticality, and compensating controls. When a patch cannot be applied, isolate the service, restrict reachable sources, add inspection and monitoring, or disable the vulnerable feature. Document the residual risk and expiry of any exception.

Monitoring is a mitigation when it enables timely detection and response, not when logs accumulate unread. Define alert logic, ownership, escalation, and validation. For example, monitoring a legacy protocol is weaker than disabling it, but may form part of a compensating package when a business dependency prevents immediate removal.

Decommissioning closes a frequently forgotten attack surface. Remove accounts, certificates, DNS records, firewall rules, agents, routes, and vendor access; sanitize or destroy data according to policy; update inventories; and retain evidence of completion. Turning a server off without removing its trust relationships leaves reusable access paths.

Avoid control theater. Encryption does not stop an authorized compromised process from reading data in use. Endpoint protection does not correct an internet-facing default password. A firewall cannot repair unsafe application authorization.

Decision rule: map the mitigation to the exact stage of the attack path, layer controls where one failure is plausible, and verify that the risk—not just the alert—was reduced.