A preventive control is designed to stop security breaches before they happen. In data center security, preventing unauthorized physical access is crucial.
Prevents Unauthorized Entry - Restricts access only to authorized personnel.
Tracks and Logs Access - Records who enters and exits the data center, enhancing security monitoring.
Enhances Security Layers - Often combined with biometric authentication or PINs for stronger access control.
Meets IT Security Standards - Aligns with ISO 27001, NIST, and IIA's GTAG recommendations on physical security.
A). Motion detectors - These are detective controls, identifying movement but not preventing unauthorized access.
C). Security cameras - Also detective, as they record events but do not prevent physical breaches.
D). Monitoring access to data center workstations - This ensures data integrity but does not prevent physical access.
IIA's GTAG (Global Technology Audit Guide) on Information Security - Recommends strong physical access controls like key cards.
NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems) - Emphasizes access control as a preventive security measure.
ISO 27001 Annex A.11 (Physical and Environmental Security) - Requires access control for secure areas, including data centers.
Why Key Card Access is the Best Preventive Control?Why Not the Other Options?IIA References:

Among the options, monitored closed circuit television is most likely to support corrective action because security personnel can observe an incident and respond to it. Although CCTV is often classified as a detective control, when actively monitored it can trigger real-time intervention, dispatch of guards, incident response, or corrective follow-up. Doors that lock automatically, biometric locks, and identification badges are primarily preventive controls because they restrict access before unauthorized entry occurs. Internal auditors should distinguish between preventive, detective, and corrective control characteristics, recognizing that some controls may support more than one function depending on how they are used. Since monitored CCTV can support response to physical security incidents, Option A is the best answer.

A virtual private network protects confidentiality by creating an encrypted communication tunnel between an internal network and an external user, site, or network. This helps prevent unauthorized parties from reading transmitted information over public or untrusted networks. A cloud network is a service environment and does not automatically protect confidentiality. A mobile network provides connectivity but may require additional security controls. An intranet is an internal private network and does not by itself safeguard transmissions to external networks. Internal auditors reviewing remote connectivity should evaluate VPN encryption, authentication, access restrictions, logging, endpoint security, and session controls. Because a VPN is specifically designed to protect external communication with encryption and secure tunneling, Option D is correct.

Reference: IIA Business Knowledge for Internal Auditing, Cybersecurity Risks section.

The internal audit strategy must be aligned with the organization's business objectives. This ensures that the internal audit function provides assurance and advisory services that support the achievement of strategic goals. While risk assessment (Option B), controls (Option C), and compliance (Option A) are important inputs, they are secondary to aligning with organizational objectives, which is the foundation of strategy.
Reference:
IIA Standards - Standard 2010: Planning; IIA Practice Guide - Developing the Internal Audit Strategic Plan.