B
Soft Control is another way of referring to Administrative control. Technical and Physical controls are NOT soft control, so any choice listing them was not the best answer. Preventative/Technical is incorrect because although access control can be technical control, it is commonly not referred to as a "soft" control Preventative/Administrative is correct because access controls are preventative in nature.it is always best to prevent a negative event, however there are times where controls might fail and you cannot prevent everything.Administrative controls are roles, responsibilities, policies, etc which are usually paper based.In the administrative category you would find audit, monitoring, and security awareness as well. Preventative/Physical pairing is incorrect because Access controls with an emphasis on "soft" mechanisms conflict with the basic concept of physical controls, physical controls are usually tangible objects such as fences, gates, door locks, sensors, etc... Detective/Administrative Pairing is incorrect because access control is a preventative control used to control access, not to detect violations to access. Source: KRUTZ, Ronald L. & VINES, Russel
D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 34.