Which of the following security control types does an acceptable use policy best represent?

An acceptable use policy (AUP) is a preventive control because its primary purpose is to deter users from engaging in prohibited activities by clearly defining what is and is not allowed. By setting expectations and outlining consequences, an AUP aims to stop security incidents before they occur. Detective controls identify incidents after they happen (e.g., intrusion detection systems). Compensating controls provide an alternative when a primary control cannot be met. Corrective controls fix problems after an incident has occurred (e.g., incident response procedures).