Which statement best describes a preventive control?

• A. A preventive control is designed to stop incidents before they occur.
• B. A preventive control detects incidents after they occur.
• C. A preventive control fixes vulnerabilities post-exploitation.
• D. A preventive control is only about physical security.

Answer: (A)

Preventive controls are proactive measures designed to stop security incidents before they happen by reducing the chance that a threat can exploit a vulnerability. They create barriers and enforce policies so problems are prevented rather than discovered or repaired after the fact. Examples include multi-factor authentication, strict access controls, network segmentation, timely patching, secure coding practices, and ongoing security training. This is why the statement describing prevention as stopping incidents before they occur fits best. By contrast, detecting incidents after they happen points to detective controls, fixing vulnerabilities after exploitation describes corrective controls, and focusing only on physical security misses the wide range of preventive measures used across people, processes, and technology.