Disabling USB access for storage devices is a preventive control because it is intended to stop malware introduction before it occurs. ISACA explicitly describes disabling USB access for storage devices as a preventive control that makes it harder for users to introduce threats such as viruses into the environment.

Option C is correct because the control works in advance of the event. It prevents users from connecting removable storage that could carry malicious software or facilitate unauthorized data transfer.

Option A is incorrect because corrective controls act after an incident to restore or remediate conditions. USB blocking does not restore anything after infection.

Option B is not the best answer because although administrative policy may require the control, the specific control being described functionally prevents an unwanted event. In CISA questions, the functional type is the better classification here.

Option D is incorrect because the control is not physical; it is a logical/technical measure enforced through system configuration.

Therefore, C is the best answer because disabling USB storage access is designed to prevent malware from being introduced through physical media.

References (Official ISACA):

ISACA, Specific Controls You Can Use — disabling USB access for storage devices is described as a preventive control.

ISACA Journal, Addressing Cybersecurity Vulnerabilities — preventive controls are used to reduce exposure before compromise.