Which statement best differentiates reactive security measures from proactive security measures?

Which statement best differentiates reactive security measures from proactive security measures?

• A. Reactive measures respond after incidents; proactive measures aim to prevent incidents through planning and threat anticipation
• B. Proactive measures aim to prevent incidents; reactive measures respond after incidents
• C. Reactive measures increase security budgets; proactive measures reduce headcount
• D. Reactive measures are for physical security; proactive are for cyber only

Answer: (A)

The main idea is the timing and purpose of actions in security. Reactive measures are actions taken after an incident to stop, contain, and recover from what happened. Proactive measures are taken before incidents occur, aiming to prevent them through planning, threat anticipation, and preventative controls. This is why the best statement stands out: it clearly ties reactive work to post-incident response and proactive work to pre-emptive planning and anticipation of threats. In practice, proactive steps include risk assessments, security planning, threat modeling, training, monitoring, and hardening defenses, while reactive steps include incident response, containment, forensics, and after-action reviews. Other options either blur timing with budgets or limit the scope to one domain, which doesn’t capture the fundamental distinction.

The main idea is the timing and purpose of actions in security. Reactive measures are actions taken after an incident to stop, contain, and recover from what happened. Proactive measures are taken before incidents occur, aiming to prevent them through planning, threat anticipation, and preventative controls. This is why the best statement stands out: it clearly ties reactive work to post-incident response and proactive work to pre-emptive planning and anticipation of threats. In practice, proactive steps include risk assessments, security planning, threat modeling, training, monitoring, and hardening defenses, while reactive steps include incident response, containment, forensics, and after-action reviews. Other options either blur timing with budgets or limit the scope to one domain, which doesn’t capture the fundamental distinction.