Exam SY0-701 topic 1 question 500 discussion

Explanation: C. SSH tunneling: SSH tunneling can securely encrypt and encapsulate unencrypted traffic sent from the legacy system. It allows the unencrypted protocol to communicate over a secure channel, ensuring sensitive data is protected in transit. This compensating control effectively mitigates the risk of sending data in cleartext. D. Segmentation: Network segmentation isolates the legacy system within a secure zone, limiting its exposure to other parts of the network. By restricting communication pathways, segmentation reduces the attack surface and protects sensitive data from unauthorized access.

I think A and D. A replaces the sensitive data with non-sensitive substitutes and D encrypts communication over an insecure network

i don't get why CD is the answer since in the question it isn't stated that they are concerned about the impact of the breach and want to contain it they are just addressing the unencrypted protocols issue?

C. SSH tunneling: This encrypts the communication between systems, ensuring the sensitive data is securely transferred. D. Segmentation: This can be used to isolate the legacy system, reducing the risk of exposing sensitive data, though it doesn’t directly encrypt the communication.

Explanation: C. SSH tunneling: SSH tunneling can securely encrypt and encapsulate unencrypted traffic sent from the legacy system. It allows the unencrypted protocol to communicate over a secure channel, ensuring sensitive data is protected in transit. This compensating control effectively mitigates the risk of sending data in cleartext. D. Segmentation: Network segmentation isolates the legacy system within a secure zone, limiting its exposure to other parts of the network. By restricting communication pathways, segmentation reduces the attack surface and protects sensitive data from unauthorized access.