A security administrator is addressing an issue with a legacy system that communicates data using an unencrypted protocol to transfer sensitive data to a third party. No software updates that use an encrypted protocol are available, so a compensating control is needed. Which of the following are the most appropriate for the administrator to suggest? (Choose two.)

SSH tunneling creates an encrypted tunnel for the unencrypted traffic, protecting data in transit when no native encryption is available. Segmentation isolates the legacy system and its unencrypted traffic from the rest of the network, limiting the impact of a potential breach. Tokenization and data masking protect data at rest or in use, but not during unencrypted transmission. Cryptographic downgrade weakens security and is not a compensating control. Patch installation is not an option since no updates are available.