Which statement best describes how segmentation, hardening, least privilege, and patching together reduce the impact of a compromised endpoint?
- AHardening removes unnecessary functionality, patching closes known flaws, least privilege limits what the compromised account can do, and segmentation limits where the compromise can reach. Correct
- BPatching guarantees that no compromise can occur, so the other three controls are redundant on a fully patched estate that follows vendor advisories.
- CSegmentation alone is sufficient because confining a compromised endpoint to a single VLAN prevents any further harm without the need for host-level controls.
- DLeast privilege addresses both attack surface and lateral movement, so segmentation and hardening primarily provide audit benefits rather than risk reduction.
Why A is correct: Each control addresses a different dimension of risk, and together they reduce both the likelihood and the blast radius of a compromise in a defence in depth pattern.
Why B is wrong: Patching only addresses known flaws and cannot prevent zero day or credential-based compromise, so layered controls are still required even on a well patched estate.
Why C is wrong: Segmentation contains reachability but does not stop damage within the segment, and an isolated host with weak privileges and unpatched software can still be abused against assets it can reach.
Why D is wrong: Least privilege limits authority but does not reduce host attack surface or restrict network reachability, and treating segmentation and hardening as audit aids understates their preventive value.