There are 6 types of security control practices. ___________ controls are management policies, procedures, and guidelines that usually effect the entire system. These types of controls deal with…

Preventive controls are designed to stop security incidents from happening in the first place, rather than defining management policies.

Detective controls are designed to identify and alert when a security incident has occurred, not to establish overall policies.

Corrective controls are designed to mitigate the impact of an incident after it has occurred, focusing on remediation.

Directive controls are management-oriented, policy-based, and procedural guidelines designed to mandate or encourage specific behaviors or configurations across an entire system or organization, often involving auditing for compliance and usability. These controls set the overall tone and framework for security, ensuring that other technical and operational controls are implemented and followed according to defined standards.

Recovery controls are a subset of corrective controls focused specifically on restoring systems and data to normal operation after a disruptive event.

"Combination" is not a recognized standalone type of security control practice in this context.