Exam SY0-701 topic 1 question 500 discussion

C. SSH tunneling protects data in transit A. Tokenization replaces sensitive data which protects the data a rest I see many answers suggesting segmentation. The question states we are transferring data to a third party, which implies over the internet. You can't segment the internet and we have already mitigated the transfer by tunneling over SSH.

Explanation: C. SSH tunneling: SSH tunneling can securely encrypt and encapsulate unencrypted traffic sent from the legacy system. It allows the unencrypted protocol to communicate over a secure channel, ensuring sensitive data is protected in transit. This compensating control effectively mitigates the risk of sending data in cleartext. D. Segmentation: Network segmentation isolates the legacy system within a secure zone, limiting its exposure to other parts of the network. By restricting communication pathways, segmentation reduces the attack surface and protects sensitive data from unauthorized access.

I think A and D. A replaces the sensitive data with non-sensitive substitutes and D encrypts communication over an insecure network

i don't get why CD is the answer since in the question it isn't stated that they are concerned about the impact of the breach and want to contain it they are just addressing the unencrypted protocols issue?

C. SSH tunneling: This encrypts the communication between systems, ensuring the sensitive data is securely transferred. D. Segmentation: This can be used to isolate the legacy system, reducing the risk of exposing sensitive data, though it doesn’t directly encrypt the communication.