Detective and preventive measures: firewalls, IDS/IPS, allow and deny lists, sandboxing, honeypots, anti-malware, ML/AI tools

Security operations deploy layers of controls that either stop malicious activity (preventive) or identify it so people and systems can respond (detective). Many tools can do both depending on how they are placed and configured. The exam expects you to know what each tool does, where it sits, what it cannot do, and how the pieces combine into defense in depth.