Which of the following measures is a preventive measure?

Question

Options

• AInstalling a logging system that enables changes in a system to be recognized
• BShutting down all internet traffic after a hacker has gained access to the company systems
• CPutting sensitive information in a safe
• DClassifying a risk as acceptable because the cost of addressing the threat is higher than the value of the

• A
  6% (2)
• B
  3% (1)
• C
  88% (29)
• D
  3% (1)

Explanation

Putting sensitive information in a safe (C) is a preventive control because it acts before any incident occurs - it physically blocks unauthorized access to data rather than responding to or recording a threat.

Why the others are wrong:

• A (logging system) is a detective control - it identifies that changes have occurred, not stops them from happening.
• B (shutting down internet after a breach) is a corrective control - it responds after the attacker already gained access.
• D (accepting a risk) is a risk management strategy, not a security control at all - it involves no protective action.

Memory tip: Think of the three control types as a timeline - Preventive (before), Detective (during/after discovery), Corrective (after). If the action happens before any threat materializes, it's preventive. A safe locks data away proactively, making it the clearest example of prevention.

No community discussion yet for this question.