An alert references attacks associated with a zero-day exploit. An analyst places a bastion host in the network to reduce the risk of the exploit. Which of the following types of controls is the analyst implementing?

The analyst is implementing a compensating control. A compensating control is an alternative measure used to achieve a security objective when a primary control cannot be implemented or is not fully effective. In this scenario, a zero-day exploit means there's no known patch or direct preventative control available. Placing a bastion host acts as an additional layer of defense, mitigating the risk posed by the unaddressed vulnerability. Detective controls identify an event after it has occurred (e.g., an IDS). Operational controls are implemented through policies and procedures (e.g., security awareness training). Physical controls protect physical assets (e.g., fences, locks). None of these accurately describe the bastion host's role in addressing an unpatched zero-day vulnerability.