Which of the following is a detective control?

Smart card authentication is a preventive control because it stops unauthorized users from gaining access before a breach occurs.

A security policy is an administrative and preventive control that defines acceptable behavior and requirements, not one that detects incidents.

An audit trail is a detective control because it logs and records system activity, allowing administrators to review and identify security incidents or policy violations after they have taken place. Unlike preventive controls that stop events, detective controls focus on discovering and documenting what has already happened. Audit trails are a classic example used in security frameworks to monitor user actions and system changes.

A continuity of operations plan is a corrective and recovery control designed to restore operations after a disruption, not to detect security events.