What type of control seeks to prevent or stop an attack from occurring?

• A. Detective Control
• B. Preventive Control
• C. Recovery Control
• D. Corrective Control

Answer: (B)

Preventive controls are designed to stop security incidents before they happen by reducing or removing opportunities for an attacker. They enforce policies and harden the environment, so an attack is blocked at the outset. Examples include firewalls that block unauthorized traffic, access controls that limit who can reach resources, encryption to protect data in transit or at rest, patch management, and multi-factor authentication. Because the goal is to prevent the attack from occurring, this type of control best fits the scenario. Detective controls detect or alert after an attack has started or occurred (like IDS or log monitoring), corrective controls fix or contain issues after detection, and recovery controls focus on restoring operations after an incident.