Network segmentation is a compensating control that can limit the ransomware spread by isolating the critical server from the broader network, thus reducing the risk of cross-contamination from other network segments. Regular patching is the primary control but is not feasible in this scenario due to legacy software constraints, making it an incorrect answer. Encrypted backups are essential, but they don't address the direct risk of the server being compromised; instead, they are more about ensuring data recovery post-incident. Similarly, frequent password rotation is a security best practice but does not effectively mitigate the specific risk of unpatched systems being exploited.