Which of the following is a detective control?

Smart card authentication is a preventive control because it stops unauthorized access before it occurs rather than detecting it after the fact.

A security policy is an administrative/directive control that establishes rules and expectations, not a mechanism for detecting incidents.

An audit trail is a detective control because it records system and user activity, allowing security personnel to identify and investigate incidents after they have occurred. It does not prevent attacks but provides evidence and visibility into what happened, which is the defining characteristic of detective controls.

A continuity of operations plan is a corrective/recovery control designed to restore operations after a disruption, not to detect security events.