Risk mitigation and risk reduction controls for providing information security are classified within three main categories, which of the following are being used?

preventive, corrective, and administrative

detective, corrective, and physical

Physical, technical, and administrative

Administrative, operational, and logical