ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A compensating control provides an alternative safeguard when the preferred control (upgrading the application to support TLS 1.2) is not immediately feasible. Terminating incoming sessions on an Application Load Balancer that is configured with a TLS 1.2-only security policy ensures every client negotiates the required protocol. The load balancer can then re-encrypt traffic to the backend with TLS 1.0, allowing the legacy application to operate unchanged while satisfying the policy for external connections.

AWS Network Firewall cannot reliably drop traffic based on the negotiated TLS version because the TLS handshake is encrypted after the ClientHello, and version filtering is not a supported feature. Encrypting EBS volumes protects data at rest and does nothing for in-transit requirements. Restricting the instance's outbound access addresses egress control, not the mandated minimum TLS version for inbound client sessions. Therefore, using an Application Load Balancer for TLS 1.2 termination is the appropriate compensating control.