Which control type best describes preventive controls with a firewall as an example?

• A. Detective; Example IDS.
• B. Corrective; Example Patch.
• C. Compensating; Example Audit.
• D. Preventive; Example Firewall.

Answer: (D)

Preventive controls are designed to stop threats before harm occurs. A firewall sits at the network edge and enforces security rules that block unauthorized traffic and allow only legitimate connections, reducing exposure proactively. That makes it a preventive control. The other mappings describe different purposes: an IDS detects suspicious activity after it occurs, so it is detective. Patches fix vulnerabilities after they’re found or exploited, so they are corrective. An audit is a review activity that provides assurance or monitors compliance, not a direct preventive measure, so it does not illustrate a preventive control like the firewall.