Which of the following is a type of countermeasure that can be deployed to ensure that a threat vector does not meet a vulnerability?

Prevention controls are specifically designed to block a threat vector from reaching a vulnerability in the first place - examples include firewalls, access controls, input validation, and encryption. Unlike detection or monitoring controls that respond after contact is made, prevention controls eliminate or reduce the attack surface before exploitation can occur.

Detection controls identify and alert on threats that have already reached or are actively interacting with a system, rather than blocking them from meeting a vulnerability.

Monitoring controls observe and record activity over time to identify anomalies, but they do not actively prevent a threat vector from reaching a vulnerable target.

Subversive controls is not a recognized category in standard security control frameworks such as NIST SP 800-53 or ISO 27001, and has no defined technical meaning in this context.