Which of the following is a preventive control?

Smart card authentication is a preventive control because it actively blocks unauthorized access attempts before they succeed, requiring both physical possession of the card and knowledge of a PIN. This two-factor mechanism prevents access rather than detecting or recovering from a breach. It directly stops an unauthorized action at the point of entry.

A security policy is a directive or administrative control that defines rules and expectations, but does not technically enforce or prevent actions on its own.

An audit trail is a detective control that records events after they occur so that suspicious activity can be identified after the fact.

A continuity of operations plan is a corrective and recovery control designed to restore operations after a disruption, not to prevent one.