Which of the following is NOT considered a preventative control?

Which of the following is NOT considered a preventative control?

• A. Firewalls
• B. Intrusion detection systems
• C. External audits
• D. Fire extinguishers

Answer: (C)

Preventative controls are security measures implemented to prevent security incidents and mitigate potential risks before they occur. Firewalls and fire extinguishers actively prevent unauthorized access and potential fire damage, respectively, making them clear examples of preventative controls. Intrusion detection systems, although they play a vital role in identifying and responding to security threats, are categorized differently because they primarily focus on detection rather than prevention. They alert administrators about potential intrusions but do not inherently prevent them. External audits, on the other hand, are evaluative measures rather than proactive ones. They assess the effectiveness and compliance of current security controls, providing insights for improvement but not directly preventing security incidents. Thus, they do not fit the definition of preventative controls and are correctly identified as the option that does not belong in this category.

Preventative controls are security measures implemented to prevent security incidents and mitigate potential risks before they occur. Firewalls and fire extinguishers actively prevent unauthorized access and potential fire damage, respectively, making them clear examples of preventative controls.

Intrusion detection systems, although they play a vital role in identifying and responding to security threats, are categorized differently because they primarily focus on detection rather than prevention. They alert administrators about potential intrusions but do not inherently prevent them.

External audits, on the other hand, are evaluative measures rather than proactive ones. They assess the effectiveness and compliance of current security controls, providing insights for improvement but not directly preventing security incidents. Thus, they do not fit the definition of preventative controls and are correctly identified as the option that does not belong in this category.