Which of the following best describes the primary purpose of preventive controls in a security context?
To identify and respond to security incidents after they occur
To substitute for primary controls when they are not available
To stop security incidents from occurring in the first place
To limit the damage caused by a security incident after it has occurred