A company security policy mandates education and training for new employees. The policy must outline acceptable use policies for SaaS applications. Given these requirements, which of the following sec

Preventive controls such as firewalls or access control lists technically block threats before they occur rather than addressing knowledge or behavioral deficiencies through education.

Detective controls such as SIEM systems or audit logs identify and alert on security incidents after they happen rather than correcting employee knowledge gaps.

Corrective controls address and remediate identified deficiencies or weaknesses in a process or system. Security education and training corrects the lack of employee knowledge about acceptable use policies for SaaS applications, thereby reducing the risk of user-driven security incidents. This differs from preventive controls because training responds to a recognized knowledge gap rather than proactively blocking a specific technical threat vector.

Physical controls involve tangible security mechanisms such as locks, fences, or surveillance cameras and do not apply to policy education or training programs.