A company security policy mandates education and training for new employees, outlining acceptable use policies for SaaS applications. Which security control is BEST suited?

A company security policy mandates education and training for new employees, outlining acceptable use policies for SaaS applications. Which security control is BEST suited?

• A. Preventive
• B. Detective
• C. Corrective
• D. Physical

Answer: (C)

The main idea here is how security controls are categorized by their purpose. Education and training for new employees about acceptable use policies is an administrative approach that aims to prevent mistakes and policy violations before they happen. By informing users what’s allowed and what isn’t with SaaS apps, the organization reduces the chance of misuse from the outset, which is the essence of preventive controls. This isn’t about detecting issues after they occur (that would be detective) or taking steps to fix problems after they arise (that would be corrective). It also isn’t about physical barriers. Training targets preemptive behavior change, so the best fit is a preventive control.

The main idea here is how security controls are categorized by their purpose. Education and training for new employees about acceptable use policies is an administrative approach that aims to prevent mistakes and policy violations before they happen. By informing users what’s allowed and what isn’t with SaaS apps, the organization reduces the chance of misuse from the outset, which is the essence of preventive controls.

This isn’t about detecting issues after they occur (that would be detective) or taking steps to fix problems after they arise (that would be corrective). It also isn’t about physical barriers. Training targets preemptive behavior change, so the best fit is a preventive control.