Which of the following is a preventive control?

A preventive control is one that stops a threat from being realized in the first place. Smart card authentication enforces multi-factor identity verification at the point of access, preventing unauthorized individuals from logging in. It acts before any breach can occur, which is the defining characteristic of a preventive control under standard security control classification frameworks.

A security policy is a directive or administrative control that establishes rules and expectations, but it does not technically enforce or block access on its own.

An audit trail is a detective control - it records events after they happen to support investigation and accountability, not to prevent incidents.

A continuity of operations plan (COOP) is a corrective or recovery control designed to restore operations after a disruption, not to prevent one.