Which statement best describes the difference between preventive and detective controls in security design?

• A. Preventive controls aim to stop incidents; detective controls detect and alert about incidents.
• B. Preventive controls only monitor outputs; detective controls prevent incidents.
• C. Detective controls prevent incidents; preventive controls detect incidents.
• D. There is no difference between them.

Answer: (A)

Preventive controls are designed to stop incidents from happening in the first place. They create barriers or reduce opportunities for unauthorized access or disruption, such as strong authentication, access controls, secure configurations, patching, and physical security measures. Detective controls, by contrast, are meant to recognize that something has happened or is happening and to raise an alert so you can respond, such as logs, intrusion detection systems, CCTV, and security alarms. In practice, you want both: preventive measures to reduce the chance of an incident, and detective measures to detect and respond quickly if something slips through. Some controls can serve dual purposes, but the distinction lies in the primary goal—stopping incidents versus identifying them after they occur.