Classify the function being performed, not the name of the device
Preventive, detective, and deterrent security controls describe what a control is doing in a specific scenario. The same platform can perform more than one role. A firewall can prevent traffic with a deny rule, detect activity through logging, and support deterrence when monitoring and consequences are communicated. The exam skill is to identify the function described by the requirement.
Prevent, discover, or discourage
Preventive
Stops or reduces the probability of an unwanted event before or while it occurs.
Detective
Identifies events, conditions, or policy violations so someone or something can respond.
Deterrent
Discourages unwanted behavior by increasing perceived consequences or reducing anonymity.
These categories are about purpose. The same technology may contribute to several categories when different features are used.
Preventive controls change whether an unwanted action can succeed
Preventive controls enforce a boundary. They deny, restrict, require, or harden something before the unwanted event completes. Examples include firewall rules, network access control, MFA, segmentation, strong authentication, secure configuration, patching, and disabling unnecessary services.
| Control | Preventive mechanism | Direct verification |
|---|---|---|
| Firewall rule | Blocks unauthorized source/port/protocol | Forbidden flow fails; required flow still works |
| 802.1X/NAC | Restricts unauthenticated or noncompliant endpoints | Unauthorized endpoint cannot obtain normal access |
| MFA | Requires additional proof beyond password | Password-only attempt fails |
| Segmentation | Limits communication between trust zones | Cross-zone prohibited traffic fails |
| Patching | Removes known exploitable flaws | Supported version and vulnerability state confirmed |
Swipe horizontally to see the preventive-control table.
Detective controls create evidence that something happened or changed
Detective controls do not necessarily stop the event. Their job is to make abnormal or unwanted activity visible. Authentication logs, IDS alerts, firewall logs, configuration-audit reports, availability monitoring, bandwidth alerts, and integrity checks all create evidence.
If the account is also automatically locked after the threshold, the lockout mechanism adds a preventive function.
Deterrence changes behavior by affecting perceived consequences
Deterrent controls are intended to discourage misuse before it occurs. Warning banners, visible cameras, posted access restrictions, communicated monitoring, and policy notices can increase perceived accountability.
Corrective controls help restore a secure or operational state after an event
Although this page focuses on preventive, detective, and deterrent controls, corrective controls are important in layered security. Restoring a known-good configuration, rebuilding a compromised host, rotating exposed credentials, applying remediation after an incident, or restoring from backup are corrective actions.
Corrective does not mean preventive. A backup can help recovery, but it does not stop the original compromise from happening.
One platform can support several security functions at the same time
A next-generation firewall can deny unauthorized traffic, log denied flows, generate alerts, and provide reports. Those are different functions inside the same system.
| Firewall feature | Primary control role | Why |
|---|---|---|
| Deny TCP/22 from guest | Preventive | Stops prohibited traffic |
| Log denied connection | Detective | Creates evidence |
| Alert on repeated scans | Detective | Identifies suspicious pattern |
| Visible monitored-use notice | Deterrent | Discourages misuse |
Swipe horizontally to see the overlap table.
Detection and prevention can look similar until you ask what happens to the traffic
An Intrusion Detection System identifies suspicious behavior and generates evidence. An Intrusion Prevention System can be placed or configured to block or disrupt traffic that matches policy.
The key question is not the product label alone. Ask whether the described behavior is “alert,” “detect,” or “report” versus “block,” “stop,” or “prevent.”
Multi-factor authentication reduces the usefulness of a stolen password
If an attacker knows a username and password but cannot complete the second factor, the control has prevented that authentication attempt from succeeding. The second factor is therefore functioning preventively in that scenario.
MFA can also produce detective evidence through login logs and push-denial events, but those logging features are separate functions.
Segmentation prevents unnecessary reachability before an attack reaches the target
Placing guest, student, IoT, management, and server populations into separate networks creates trust boundaries. Firewall or ACL policy between those segments determines which flows are permitted.
This is preventive because unauthorized reachability is denied before the protected service can be accessed.
Patching removes known opportunities before they can be used
Applying security updates can close vulnerabilities that would otherwise be exploitable. Patching is therefore preventive when its purpose is to reduce attack opportunities.
Logs become useful only when they contain enough context to support a decision
A useful security log should identify time, source, destination or account, action, and outcome. Logs can reveal repeated failures, blocked connections, configuration changes, or unusual patterns.
This is detective evidence describing what the preventive firewall rule did.
Monitoring can reveal conditions that are not obvious to users yet
Availability checks can detect a server outage. Bandwidth monitoring can identify saturation. Configuration monitoring can reveal unauthorized changes. Authentication monitoring can surface a brute-force pattern.
Detection has value because prevention is never perfect. Strong defense assumes some events will still need to be observed and investigated.
Deterrence depends on the person believing monitoring or consequences are real
A warning banner nobody sees cannot discourage behavior. A visible camera with a clearly communicated policy may create more deterrent effect because the user perceives that actions are attributable.
But deterrence remains behavior-oriented. It should support—not replace—technical access control.
Guests must not reach payroll systems
The requirement is to stop guest devices from reaching the payroll subnet. A firewall rule between the guest and payroll zones denies that traffic.
Classification: preventive. Verification: guest Internet still works, but guest-to-payroll traffic fails.
Alert after repeated failed login attempts
The requirement says the security team must be notified after 50 failed logins from one account in ten minutes.
Classification: detective. The system identifies the pattern and generates evidence. If the account is also locked, that lockout adds a preventive control.
A warning banner appears before administrators log in
The message states that access is restricted and activity is monitored.
Classification: deterrent. The banner communicates consequences but does not authenticate the administrator or enforce network policy by itself.
A NAC system quarantines unpatched endpoints
The endpoint is assessed before receiving normal LAN access. Devices that fail the requirement are placed into a restricted remediation network.
Classification: preventive. The control stops noncompliant endpoints from receiving normal access. Logging the quarantine event is detective.
An IDS sees an exploit attempt but does not block it
The IDS generates an alert and packet evidence while the traffic continues through the network.
Classification: detective. The presence of an alert does not mean the attack was prevented.
Security-control questions often reveal the answer through the verb
| Prompt wording | Likely control function | Reasoning |
|---|---|---|
| Stop, block, deny, require | Preventive | Changes whether event can succeed |
| Alert, log, detect, report | Detective | Creates evidence or visibility |
| Warn, discourage, announce monitoring | Deterrent | Influences behavior |
| Restore, rebuild, recover | Corrective | Returns system to desired state |
Swipe horizontally to see the wording matrix.
Each control proves only the security function it actually performs
| Observation | Supports | Does not prove |
|---|---|---|
| Firewall blocked one port | That flow was prevented | No other attack path exists |
| IDS generated alert | Suspicious activity was detected | Traffic was stopped |
| Warning banner displayed | User was warned | User was authenticated |
| Backup restored successfully | Recovery succeeded | Original compromise was prevented |
| MFA login succeeded | Required factors were satisfied | Every account action is legitimate |
Swipe horizontally to see the evidence-boundary table.
Layered security works because different controls fail in different ways
Prevention reduces successful attacks. Detection identifies what gets through or what legitimate users misuse. Deterrence influences behavior. Corrective controls help recover.
The strength comes from independent layers rather than assuming one control is perfect.
Where a control sits affects which events it can influence or observe
A host firewall protects one endpoint. A network firewall can enforce policy between many subnets. NAC influences admission to the network. An IDS sensor sees only the traffic visible at its monitoring point. A camera deters behavior only where users know or believe they are observed.
When a question gives topology, connect the control category to its placement and scope.
A detective control is only as useful as its signal quality and response process
Too many false positives can cause important alerts to be ignored. Too little logging can make an incident impossible to reconstruct. High-value detection has clear timestamps, useful context, reasonable thresholds, and a defined response path.
Strong prevention should block unwanted behavior without breaking required service
A firewall rule that blocks all guest traffic is preventive, but it is a poor solution if guests still require Internet access. A NAC policy that rejects every device may be secure but unusable.
Verification therefore needs both sides of the requirement: authorized behavior succeeds, prohibited behavior fails.
One event can trigger preventive, detective, deterrent, and corrective responses
Classify each action independently. Do not assign one category to the entire incident.
Most classification errors come from confusing evidence with enforcement
- An IDS alert does not automatically mean the traffic was blocked.
- A warning banner does not authenticate a user.
- A firewall device is not “preventive only”; its logs are detective.
- A backup is primarily corrective when used for restoration.
- A camera can deter and detect depending on how it is used.
- A control should be classified by the specific function described in the prompt.
Build the answer from requirement, function, mechanism, overlap, and verification
Requirement: what security outcome is needed?
Category: preventive, detective, deterrent, or corrective.
Mechanism: explain how the control produces that outcome.
Overlap: note whether another feature of the same system serves another category.
Evidence boundary: state what the control does not prove.
Verification: test the required security outcome directly.
When the ideal control is unavailable, a compensating control can reduce the same risk in another way
Security design is not always able to use the first-choice control. A legacy device may not support modern authentication, or an application may require a protocol that cannot be disabled immediately. In those cases, a compensating control can reduce risk while preserving the required function.
For example, if an old management interface cannot use MFA, an administrator might restrict access to a management VLAN, permit only a small source range through the firewall, require VPN access first, and monitor every login. Those controls do not magically turn the legacy interface into a modern one, but together they reduce exposure.
This is another reason to classify functions rather than products. One compensating design can combine several control categories.
The control category and the control type answer different questions
Preventive, detective, and deterrent describe purpose. Administrative, technical, and physical describe how the control is implemented. A policy requiring MFA is administrative; the MFA system enforcing it is technical. A visible camera can be physical and deterrent at the same time.
| Control | Implementation type | Primary function |
|---|---|---|
| Firewall deny rule | Technical | Preventive |
| Login warning banner | Technical presentation of administrative policy | Deterrent |
| Security camera | Physical | Deterrent and potentially detective |
| Access-review policy | Administrative | Detective/governance |
Swipe horizontally to see the classification table.
A control can exist on paper but fail operationally
A detective control that nobody reviews may generate alerts without producing action. A preventive rule that is too broad may block legitimate traffic and be disabled by frustrated users. A deterrent notice that nobody sees has little practical influence. Control effectiveness therefore depends on implementation quality, placement, maintenance, and response.
On an AP Networking question, separate “this control exists” from “this control achieves the requirement.” The stronger answer explains the intended function and the verification evidence that shows whether the control actually works.
Choose the category from the requirement, then choose the mechanism
| Requirement | Primary category | Strong mechanism |
|---|---|---|
| Stop unmanaged laptops from joining production LAN | Preventive | 802.1X/NAC with quarantine |
| Know when a privileged account fails login repeatedly | Detective | Authentication monitoring and alert threshold |
| Discourage unauthorized console access | Deterrent | Visible monitoring notice plus controlled physical space |
| Restore switch configuration after corruption | Corrective | Verified configuration backup and recovery procedure |
Swipe horizontally to see the selection drill.
24 Preventive vs. Detective vs. Deterrent Controls digital flashcards
Practice control purposes, firewalls, NAC, MFA, segmentation, patching, IDS/IPS, logs, monitoring, warning banners, overlap, defense in depth, and exam classification.