Certified Ethical Hacker (CEH) Practice Question

Security controls are often grouped by their primary function: preventive, detective, corrective, deterrent, and compensating. A web-application firewall rule that inspects traffic and blocks malicious SQL-injection payloads acts before the attack can succeed, thereby stopping the exploitation from occurring. That is the hallmark of a preventive control.

A detective control (such as log monitoring) only identifies an attack after it happens; a corrective control (such as applying a patch or restoring from backup) attempts to fix damage that has already occurred; a compensating control provides an alternate safeguard when the preferred control is infeasible but does not necessarily prevent the action itself. Therefore, the most accurate classification for the proposed WAF rule is preventive.