Requiring visitors to present identification and pre-approval documents before entering a data center is a preventive control because its purpose is to stop unauthorized access before it occurs. In CISA-style control classification, a preventive control is designed to avoid an incident or reduce the likelihood of an undesirable event. Screening visitors before access is granted is a classic example of prevention.
Option B is correct because the control is applied before access is granted. It is intended to prevent unauthorized individuals from entering the facility. The control does not primarily detect an event after it happens, nor does it correct a problem after occurrence.
Option A is tempting because visitor procedures are often documented in administrative policies, but the question asks for the type of control implemented in this scenario. The specific mechanism described is an entry-screening measure that functions preventively. In exam logic, when asked to choose between functional control types such as preventive, detective, and corrective, the answer should reflect what the control actually does.
Option C is incorrect because a corrective control acts after an incident to restore or remedy conditions.
Visitor ID checks do not correct anything after a breach.
Option D is incorrect because a detective control identifies or alerts after or during an event, such as logs, CCTV review, or alarms. Here, the main purpose is to prevent unauthorized access before entry.
So the best answer is B, since requiring ID and pre-approval documents at the entrance is designed to prevent unauthorized physical access to the data center.
References (Official ISACA):
ISACA, Differentiating Key Terms in the Information Security Hierarchy - standards and controls can prescribe required behaviors and control actions.
ISACA Journal, Information Systems Security Audit: An Ontological Framework - supports functional security control categories.
ISACA Journal, IS Audit Basics: Innovation in the IT Audit Process - supports use of standard ISACA terminology in control evaluation.

The most appropriate testing approach when auditing a daily data flow between two systems via an automated interface is to perform data reconciliation between the two systems for a sample of 25 days. Data reconciliation is a process of verifying that the data transferred from one system to another is complete and accurate, and that there are no discrepancies or errors in the data flow1. Data reconciliation can be performed by using generalized audit software, which is a type of computer-assisted audit technique (CAAT) that allows the IS auditor to perform various audit tasks on the data stored in different file formats and databases2. By performing data reconciliation for a sample of 25 days, the IS auditor can test the reliability and consistency of the data flow over a reasonable period of time, and identify any potential issues or anomalies that could affect the quality of the data or the functionality of the systems.
References
1: Data Flow Testing - GeeksforGeeks 2: Generalized Audit Software (GAS) - ISACA

The best recommendation to include in an organization's bring your own device (BYOD) policy to help prevent data leakage is to require multi-factor authentication on BYOD devices. BYOD is a practice that allows employees to use their own personal devices, such as smartphones, tablets, or laptops, to access the organization's network, data, and systems. Data leakage is a risk that involves the unauthorized or accidental disclosure or transfer of sensitive or confidential data from the organization to external parties or devices.
Multi-factor authentication is a security measure that requires users to provide two or more pieces of evidence to verify their identity and access rights, such as passwords, tokens, biometrics, or codes. Multi-factor authentication can help prevent data leakage by reducing the likelihood of unauthorized access to the organization's data and systems throughBYOD devices, especially if they are lost, stolen, or compromised. The other options are not as effective as requiring multi-factor authentication on BYOD devices, because they either do not prevent data leakage directly, or they are reactive rather than proactive measures. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.3

The correct answer is B. To provide secure key management.
The primary objective of hardware-based encryption in a banking system is to protect cryptographic keys and perform cryptographic operations in a secure, tamper-resistant environment. Banking systems commonly use hardware security modules, or HSMs, to protect keys used for payment processing, PIN handling, authentication, transaction signing, and encryption.
ISACA states that HSMs are widely recognized as one of the most secure ways to manage encryption and that organizations need HSMs for robust key management across the key life cycle, including generation, issuance, revocation, and rotation. ISACA also notes that cryptographic infrastructures are commonly built around FIPS-validated HSMs to provide a high level of security for encryption keys.
Option A is not the best answer because hardware-based encryption may make some key-management activities more controlled and centralized, but it does not necessarily simplify the process. In fact, HSMs can introduce operational complexity.
Option C is not the best answer because hardware encryption may improve cryptographic processing performance in some cases, but efficiency is not the primary reason for using it in a banking environment.
Option D is not the best answer because hardware-based encryption does not primarily exist to increase key length. Key length is determined by the encryption algorithm and security requirements, not simply by whether encryption is hardware-based.
This question maps to Protection of Information Assets because the CISA Exam Content Outline includes data encryption and public key infrastructure under Domain 5.
References: ISACA CISA Exam Content Outline, Domain 5; ISACA guidance on HSMs, encryption, and key management.