Locking user accounts after three unsuccessful login attempts is an example of a preventive control. It aims to prevent unauthorized access by stopping an action or event before it can occur. In this case, it is preventing a potential attacker from guessing a user’s password through repeated attempts.