Exam CISSP topic 1 question 180 discussion

very very unreal scenario. They haven't money for Surge protectors but want DR capabilities

Key here is "the site". If surge hits and nothing is protecting the hardware the entire site could be down and PSU fried. DR site would be elsewhere and be unaffected.

A compensating control is a control that reduces risk when the primary control (in this case, surge protectors) is not in place. Since surge protectors help protect equipment from power surges or electrical events, the closest compensating control is having a hot DR site

sorry guys option B after rethinking this. Generator does not help with surges, it restores power. In case there is a surge and the servers are toast, there is no business continuity at which time the DR comes handy. Though expensive than a generator from a compensating control DR makes sense

A hot disaster recovery (DR) site is designed to take over operations in the event of a major failure or disaster, ensuring business continuity. However, it doesn't specifically address the issue of electrical surges at the primary site. Electrical surge protectors are meant to protect equipment from voltage spikes that can cause immediate damage or degrade the performance of electronic components over time12. Backup diesel generators, on the other hand, can provide a continuous power supply during electrical disturbances, including surges, thereby directly mitigating the risk associated with not having surge protectors

The CISSP Official Study Guide, Domain 7 (Security Operations), discusses compensating controls as alternative measures designed to mitigate risks when primary controls are absent. Backup power solutions, like diesel generators, are commonly cited as compensating controls for electrical power risks, including surges and outages.

The answers would make a little more sense if it were worded you do not have a backup generator what would be a compensating control. or you do not have UPS what would be a compensating control.

You walk up to the director of IT and say we do not ahve surge protection, but dont worry we have an hot site avialable. You are looking for a job becuse you are too stupid to requisition surrge protectors .

HOT site is better than having diesel generators? i mean thats not a realistic implementation of this. Having backup ANY kind of generators would be suffice generally and is a more realistic answer to such scenario. I have to go against the grain. D

interesting that literally every question here seems wrong. The question isnt about loss of power. Does literally no one know what a surge protector does? Surge protector is not a control protecting the entire building. Therefore a DR hot site and a backup generator is overkill. A generator would be a compensating control for UPS but not a surge protector. Surge protectors are controls that protect a piece of equipment. Therefore a valid compensating control would be having redundancy for that system. AKA active/active clusters ---> network equipment can apply to servers as well

I don't think B is a correct answer. Imagine you are a manager, you come to the director of the company and he said "Look, we don't have surge protectors. What are we going to do when a surge happens?" You say "No worries, we will just move to another buillding!" :)

If we think as a Manager, and the main problem is power failures, a "compensatory control" that is, not the best solution but something that helps when the best option which is a DR site is not viable, is having "backup diesel generators ". I go with D

Agree the question does not make a lot of sense.. but thinking for cost effective and considering that no surge protectors... it is very expensive to have hot disaster recovery DR... looking at C. active-active to clusters... can ensure data protection and integrity and availability considering that clusters are connected to different power sources.. I think C. can be a good answer as well.

In the event of electrical surges that could potentially damage systems, a hot DR environment provides redundancy by replicating critical systems and data in a separate location. This ensures that essential services can quickly fail over to the DR environment, minimizing downtime and data loss.

D is correct

Other answers don't make sense with the given scenario

If an electrical surge occurs, the systems themselves could be fried. An alternate source of power like a diesel generator will not help. They only solution to frying your actual systems from these options is an alternate DR site.