Acceptable Use Policy Security Control Type
Short answer
D An Acceptable Use Policy is a preventive control that sets rules to deter and stop unauthorized user behavior before security incidents occur.
Question
Key Takeaways
This question tests the classification of administrative controls, specifically identifying that policies designed to guide user behavior are preventive rather than detective or corrective.
An Acceptable Use Policy (AUP) is classified as a preventive security control because it establishes rules to deter and stop unauthorized or malicious activities before they occur.
Common mistake: Learners often confuse AUPs with directive controls; while some sources use 'directive', in the context of SY0-701 options where 'Directive' is absent, 'Preventive' is the correct functional classification.
Expert Analysis
Why the Answer Is Correct
An Acceptable Use Policy (AUP) is an administrative control that defines acceptable and unacceptable behaviors for users. By establishing these rules and expectations, the policy aims to deter users from engaging in risky or prohibited activities, thereby preventing security incidents before they happen. In the CompTIA Security+ (SY0-701) framework, when 'Directive' is not an option, administrative policies like AUPs are categorized as Preventive controls because their primary function is to stop violations.
Why the Other Options Are Wrong
Detective controls (A) identify and log events after they occur or are in progress, such as intrusion detection systems; an AUP does not monitor activity. Corrective controls (C) restore systems to normal operation after an incident, such as backups or patching; an AUP does not fix damage. Compensating controls (B) are alternative measures used when primary controls are ineffective; an AUP is a primary control itself, not a substitute.
Community Comment Notes
The vast majority of learners correctly identified D as the answer, noting that the policy's purpose is to prevent misuse through clear guidelines. One commenter noted that Jason Dion's course classifies AUPs as 'Directive' controls, which explains why some might hesitate if they recall that terminology, but confirmed that 'Preventive' is the best fit among the provided options. Another user emphasized that policies cannot physically stop attacks, but in the context of control types, the intent to deter makes them preventive.
Exam Strategy
When analyzing administrative controls, determine their primary function: do they stop an event (Preventive), find an event (Detective), or fix an event (Corrective)? For AUPs, since they set rules to avoid bad behavior, they are Preventive unless 'Directive' is explicitly listed as an option.
Frequently Asked Questions
Why is an AUP considered preventive instead of directive?
Can an AUP be a compensating control?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 12 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 12
-
TheMichael 👍 13 Answered DD. Preventive AUP is pretty obviously trying to prevent things from happening. It's not A. Detective because it doesn't detect anything. It's a policy. It's not B. Compensating because it isn't making up for any other policy included in the question. It's not C. Corrective because it doesn't correct anything on it's own, it's simply a policy that is to be followed. So it could only be D. Preventive, as it prevents people from doing things that might compromise the network.
-
noragami 👍 8 Answered DAn acceptable use policy best represents: D. Preventive An acceptable use policy is designed to prevent security incidents by defining the acceptable and unacceptable behaviors and actions for users within an organization. By setting clear guidelines and expectations, it aims to prevent misuse and ensure that users adhere to security protocols, thereby reducing the risk of security breaches.
-
MAKOhunter33333333 👍 4 Answered DAUP = lets user know what is acceptable and allowed to prevent them from performing certain activity
-
Gadoof 👍 3 Answered BIt's impossible for a policy to be a detective, corrective, or preventative control as a policy CANNOT stop/prevent, or detect any attack in any way. It has to be B
-
ebomuchekingsley 👍 3Policies are usually a type of preventive admin control.
Show 7 more comments
-
Examplary 👍 2I find myself wondering if the actual exam uses "Directive" as A instead of Detective. Jason Dion's course actually used AUP as it's example of a Directive Control: Directive Controls - Often rooted in policy or documentation and set the standards for behavior within an org. Ex. Acceptable Use Policies (AUPs). Guides the entire process.
-
rjbb 👍 2 Answered Dpreventive - an acceptable use policy enforces rules to users to use company resources. example - company A states that in order to access files in the company server you must connect to your company VPN when working from home. This prevents you from connecting from an insecure network.
-
dbrowndiver 👍 1 Answered DAn acceptable use policy serves as a preventive measure by clearly outlining what constitutes acceptable and unacceptable behavior. This deters employees from engaging in activities that could lead to security breaches or misuse of resources. Education: By educating users about proper usage and potential consequences of violations, the policy reduces the likelihood of accidental or intentional security incidents. Legal and Compliance: AUPs also help establish a legal framework for acceptable use, which can prevent legal liabilities and ensure compliance with regulatory requirements. Why it is is the best choice: The primary goal of an AUP is to prevent misuse of IT resources by setting clear expectations and guidelines. By defining what is acceptable, the policy acts as a preventive control, helping to mitigate risks before they materialize.
-
braveheart22 👍 1 Answered DAn Acceptable Use Policy sets guidelines and rules for how users should behave when using an organization's network, devices, and other resources. It is preventive in nature because it aims to prevent improper behavior and reduce the likelihood of security incidents before they occur by clearly defining acceptable and unacceptable actions. Preventive controls aim to deter security violations or unwanted behaviors from happening in the first place. AUPs prevent misuse of resources by setting clear boundaries on what is and isn’t allowed, such as restrictions on accessing certain websites or using unauthorized software.
-
dbrowndiver 👍 1 Answered DBy restricting access to the administrator console to just the IT manager and the help desk lead, the IT manager is implementing least privilege. This ensures that only those who need elevated access for their roles can use administrative functions, reducing the risk of unauthorized changes or misuse.
-
PAWarriors 👍 1 Answered DAcceptable Use Policy (AUP) is a preventive security control type. AUP is a document that outlines the do's and don'ts for users when interacting with an organization's IT systems and resources and defines appropriate and prohibited use of IT systems/resources as a preventive security control.
-
elbarozz 👍 3 Answered Dits clearly D
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →