A SOC 2 report provides information about the design and the operating effectiveness of the controls at a service organization relevant to the confidentiality, integrity, and availability of the IS and the data that are used for providing the services or the solutions to the user entities or the customers. A SOC 2 report is based on the Trust Services Criteria (TSC), which are the standards and the guidelines for evaluating and reporting the security controls of the service organization. A SOC 2 report can help an organization to understand a vendor's IS in relation to confidentiality, integrity, and availability, by:
Evaluating and assessing the vendor's IS and the controls against the TSC, such as the security, the availability, the processing integrity, the confidentiality, or the privacy, and determining whether they are suitably designed and operating effectively to ensure the protection and the reliability of the IS and the data.
Providing and presenting the information and the data about the vendor's IS and the controls in the form of the audit report or the opinion that is prepared and issued by the independent auditor or the practitioner, and that is intended for the general or the restricted use of the organization and the other interested or relevant parties or stakeholders.
Comparing and benchmarking the vendor's IS and the controls with the industry standards and the best practices, and with the expectations and the requirements of the organization and the other interested or relevant parties or stakeholders, and identifying and addressing the gaps or the issues that may exist or arise in the vendor's IS and the controls.

Explanation/Reference:
Explanation:
An IPS detects intrusive activity and also prevents the traffic from gaining access to the target.
Incorrect Answers:
A, B, D: Intrusion Detection Systems detect intrusive activity and generates an alert. It does not take action when a possible intrusion is detected.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 255-266

All of the above are considered technical controls except for locks, which are physical controls.
Administrative, Technical, and Physical Security Controls
Administrative security controls are primarily policies and procedures put into place to define and guide employee actions in dealing with the organization's sensitive information.
For example, policy might dictate (and procedures indicate how) that human resources conduct background checks on employees with access to sensitive information. Requiring that information be classified and the process to classify and review information classifications is another example of an administrative control. The organization security awareness program is an administrative control used to make employees cognizant of their security roles and responsibilities. Note that administrative security controls in the form of a policy can be enforced or verified with technical or physical security controls. For instance, security policy may state that computers without antivirus software cannot connect to the network, but a technical control, such as network access control software, will check for antivirus software when a computer tries to attach to the network.
Technical security controls (also called logical controls) are devices, processes, protocols, and other measures used to protect the C.I.A. of sensitive information. Examples include logical access systems, encryptions systems, antivirus systems, firewalls, and intrusion detection systems.
Physical security controls are devices and means to control physical access to sensitive information and to protect the availability of the information. Examples are physical access systems (fences, mantraps, guards), physical intrusion detection systems (motion detector, alarm system), and physical protection systems (sprinklers, backup generator).
Administrative and technical controls depend on proper physical security controls being in place. An administrative policy allowing only authorized employees access to the data center do little good without some kind of physical access control.
From the GIAC.ORG website

The analysis that is performed to protect information assets is the cost benefit analysis, which is a method of comparing the costs and benefits of different security solutions or alternatives. The cost benefit analysis helps to justify the investment in security controls and measures by evaluating the trade-offs between the security costs and the security benefits. The security costs include the direct and indirect expenses of acquiring, implementing, operating, and maintaining the security controls and measures. The security benefits include the reduction of risks, losses, and liabilities, as well as the enhancement of productivity, performance, and reputation.