(ISC)2 Certified in Cybersecurity Practice Exam

What is the primary function of a preventive control?

1. Identify existing security issues

2. Address security threats post-incident

3. Stop a security issue from occurring

4. Evaluate risk exposure

The correct answer is: Stop a security issue from occurring

The primary function of a preventive control is to stop a security issue from occurring. Preventive controls are proactive measures implemented to reduce the likelihood of a security incident. These controls are designed to thwart potential threats before they can manifest into actual problems, thus enhancing an organization's overall security posture. For instance, firewalls, access controls, and encryption are all examples of preventive controls. Each of these measures acts as a barrier against unauthorized access or data loss, effectively preventing potential security breaches. The focus of preventive controls is on anticipating potential vulnerabilities and implementing strategies to mitigate those risks before they can lead to harmful incidents. In contrast, identifying existing security issues pertains to the role of detective controls, which aim to discover vulnerabilities after they have already occurred. Addressing security threats post-incident is aligned with corrective controls, which are initiated once an incident has taken place to repair or restore systems and data. Evaluating risk exposure primarily relates to risk assessment processes, which help organizations understand their risk landscape but do not directly prevent incidents from occurring. Hence, the essence of preventive controls lies in their ability to avert potential security threats, making the choice that highlights this function the most accurate.