Which of the following controls primarily detects abuse of privilege but does not prevent it?

The offboarding process includes reviewing a departing employee's assigned access rights and account activity to identify any excess privileges or anomalous actions, making it detective in nature. However, because this review occurs at or after the end of employment, it cannot stop privilege abuse that already took place, meaning it detects the condition of abuse rather than preventing it.

Separation of duties is a preventive control that structures roles so no single individual can complete a sensitive transaction alone, actively blocking the opportunity for abuse before it occurs.

Least privilege is a preventive control that limits what a user can do by restricting their access rights, stopping abuse of privileges that were never granted.

Job rotation can surface irregularities when a new person takes over a role and reviews prior work, but it primarily serves as a deterrent and its detection function differs from the post-employment account review that characterizes offboarding.