Which type of security control acts before an incident to reduce the likelihood that an attack can succeed?

Which type of security control acts before an incident to reduce the likelihood that an attack can succeed?

• A. Detective
• B. Preventive
• C. Deterrent
• D. Corrective

Answer: (B)

The main idea here is proactive protection. Preventive controls are put in place before anything happens to reduce the chance that an attack can succeed. They aim to block or limit threats before they can exploit vulnerabilities. Examples include applying patches, enforcing strong access controls, multi-factor authentication, secure configuration, and network segmentation. These measures stop attackers from gaining footholds or abusing weaknesses in the first place. Detective controls, by contrast, look for and indicate that something has already occurred, so they help you respond after an incident. Deterrent controls discourage or raise the cost for attackers but don’t necessarily stop an attack from succeeding. Corrective controls come into play after an incident to restore systems and reduce downtime, not to prevent the attack itself. So the option described is the preventive type of control because it aims to reduce the likelihood of a successful attack by acting before any incident occurs.

The main idea here is proactive protection. Preventive controls are put in place before anything happens to reduce the chance that an attack can succeed. They aim to block or limit threats before they can exploit vulnerabilities. Examples include applying patches, enforcing strong access controls, multi-factor authentication, secure configuration, and network segmentation. These measures stop attackers from gaining footholds or abusing weaknesses in the first place.

Detective controls, by contrast, look for and indicate that something has already occurred, so they help you respond after an incident. Deterrent controls discourage or raise the cost for attackers but don’t necessarily stop an attack from succeeding. Corrective controls come into play after an incident to restore systems and reduce downtime, not to prevent the attack itself.

So the option described is the preventive type of control because it aims to reduce the likelihood of a successful attack by acting before any incident occurs.