What is a preventive control?
A preventive control makes an attack or unwanted action fail. It acts before or at the moment of the attempt, and it works whether or not the attacker is discouraged, because it doesn't depend on the attacker's choices. A locked door stops the person who ignored the warning sign, and a firewall rule drops the packet no matter who sent it. Preventive is one of the control types Security+ uses to describe what a control does, alongside deterrent, detective, corrective, compensating and directive.
Examples across the control categories
A control's type describes its function and its category describes how it is implemented, so preventive controls exist in every category:
| Category | Preventive examples |
|---|---|
| Technical | Firewall deny rules, MFA, file permissions, encryption, application allow lists, an IPS dropping packets inline |
| Physical | Door locks, bollards, access control vestibules, locked racks |
| Managerial | Separation of duties, background checks before hiring |
| Operational | A guard refusing entry to someone without a badge, a help desk callback before a password reset |
Example: account lockout
A domain's lockout policy locks an account after 10 failed attempts. A password-guessing tool that could try thousands of passwords an hour now gets about 10 before the account locks. The threshold treats a curious student and a professional crew the same way: both are stopped. The Windows events that record the attempt belong to a different type:
4625 An account failed to log on. Account Name: j.alvarez
4740 A user account was locked out. Account Name: j.alvarez
The lockout is preventive. The 4625 and 4740 records are detective, because they tell an analyst the attempt happened.
Preventive controls still fail
No preventive control is perfect. Users approve fraudulent MFA push prompts, firewalls permit whatever their rules allow, and locks can be picked or doors propped open. Lockout itself can be abused to deny service to real users. That is why prevention is always paired with detection, to notice what got through, and correction, to repair the damage. Layering them is the idea behind defense in depth.
Preventive vs. deterrent vs. detective
A deterrent changes the attacker's mind; a preventive control works even when the attacker's mind doesn't change. Ask what happens when someone ignores the control. If they get through, it was a deterrent. A detective control, such as an IDS or a camera, records the event but doesn't stop it, which is why a camera is the wrong answer to which control would have stopped a break-in. Configuration matters: an IDS that alerts is detective, while an IPS inline that drops traffic is preventive. Timing matters for patching: routine patching before any exploitation is preventive, while patching the flaw an attacker used last night is corrective.
Preventive control on the CompTIA Security+ exam
Control types are part of SY0-801 objective 1.1. Verbs such as block, stop, deny, restrict and prevent point to preventive. Keep type and category separate: a door lock is physical in category and preventive in type, and separation of duties is managerial and preventive. Distractors usually include deterrent controls (signs, banners, visible cameras) and detective controls (logs, alerts, recordings). When a question asks for the BEST way to stop something, pick the control that makes the attempt fail, not one that discourages or records it.