Which of the following is a preventive control?

Smart card authentication is a preventive control because it physically and technically prevents unauthorized users from gaining system access before any breach can occur. It requires possession of the card combined with a PIN or biometric factor, enforcing access restriction proactively rather than detecting or recovering from a violation. This is a direct implementation of prevention at the authentication boundary.

A security policy is an administrative or directive control that establishes rules and requirements, but it does not technically prevent unauthorized actions by itself.

An audit trail is a detective control - it records events after they happen so that unauthorized activity can be identified and investigated, not blocked.

A continuity of operations plan is a corrective or recovery control designed to restore operations after a disruption, not to prevent one from occurring.