A comprehensive cybersecurity approach combines prevention with the ability to respond when prevention fails.

### Why this is right Preventive safeguards reduce the chance of an attack, but they cannot ensure that every attack will be stopped. Response capabilities help limit damage when an incident occurs. ### The concept Proactive and reactive work address different stages of risk. Prevention reduces weaknesses and exposure; response deals with consequences and recovery. Organizations need both because attackers, technology, and organizational conditions change. ### The other options - **False**: this would wrongly suggest that either prevention or response alone is sufficient in all circumstances. ### Terms - **Incident**: An event that affects or threatens systems, information, or operations. - **Response planning**: Preparing roles and actions for handling incidents. ### Remember Prevent where possible and prepare to respond when prevention fails.