Explain the purpose of mitigation techniques used to secure the enterprise
Segmentation, access control, isolation, patching, encryption, monitoring, hardening, and least privilege.
- Reading time
- 22 min read
- Flashcards
- 17 cards
- Practice questions
- 8 questions · 2 PBQs
Domain 2 closes by turning the previous four objectives around: given a threat, which mitigation applies? Most of the individual techniques appear elsewhere — here you are matching them to attacks.
The techniques
Segmentation
Dividing the network so a compromise in one area cannot reach another. The single most effective way to limit blast radius, and the standing answer for systems that cannot be patched.
Access control
ACLs and permissions restricting who can reach what. Underpinned by least privilege (4.6).
Isolation
Separating a system entirely — quarantine networks, air gaps, sandboxes.
Patching
Removing the vulnerability itself. The most complete fix when it is available.
Encryption
Protecting data so that stealing it yields nothing usable.
Monitoring
Detecting what the preventive controls missed.
Least privilege
Minimum access necessary. The most frequently correct principle on the exam.
Configuration enforcement
Ensuring systems stay at their secure baseline — the answer to configuration drift (4.1).
Decommissioning
Removing systems no longer needed. An asset that does not exist cannot be attacked.
Hardening techniques
CompTIA lists these specifically:
- Encryption on the endpoint
- Installing endpoint protection (EDR)
- Host-based firewall — filters traffic at the machine
- Host-based intrusion prevention system (HIPS) — blocks attacks at the machine
- Disabling ports and protocols not in use
- Changing default passwords
- Removing unnecessary software
Host-based firewall
- Allows or denies connections
- Judges by address, port, protocol
HIPS
- Inspects for attack patterns
- Blocks malicious content within allowed traffic
The tellA firewall decides whether the connection may happen. HIPS decides whether what is inside it is an attack.
Check yourself
Legacy medical devices cannot be patched or replaced for two years. Which mitigation limits the risk most effectively?
Matching mitigation to threat
The actual skill. Some reliable pairings:
| Threat | Primary mitigation |
|---|---|
| Unpatchable legacy system | Segmentation + monitoring |
| Stolen laptop | Full-disk encryption |
| Phishing | Awareness training + email filtering + MFA |
| Credential stuffing | MFA + unique passwords |
| Lateral movement after compromise | Segmentation + least privilege |
| Malware on endpoints | EDR + application allow lists |
| Data exfiltration | DLP + monitoring |
| Insider threat | Least privilege + monitoring + attestation |
| Zero-day | Behavioural EDR + segmentation |
Layering
Every technique here is partial. Segmentation does not stop the initial compromise; EDR does not stop a determined attacker; training does not stop every click. Defence in depth assumes each control will sometimes fail and arranges that no single failure is fatal.
Check yourself
Which control best protects against an attacker who has obtained a valid username and password through phishing?