Which statement best describes a preventive control?

• A. A firewall blocking unauthorized access.
• B. A data backup stored offsite.
• C. An incident response plan activated after a breach.
• D. A disaster recovery plan used after an outage.

Answer: (A)

Preventive controls aim to stop threats before they cause harm. A firewall blocking unauthorized access does exactly that by filtering traffic at the network boundary and preventing attackers from reaching internal systems. It reduces the chance of a breach occurring in the first place.

In contrast, an offsite data backup is primarily a recovery/continuity measure: it helps restore data after a loss but does not prevent the loss from happening. An incident response plan activated after a breach is part of detecting and responding to an incident, not preventing it. A disaster recovery plan used after an outage is about restoring operations after disruption, another recovery activity rather than prevention.

So the firewall best embodies a preventive control because it stops potential problems before they arise.