Which of the following security controls should be implemented to discover an employee with elevated access rights copying information from a cloud database?

Reviewing user accounts identifies who has access but does not reveal whether an authorized user is actually misusing that access to copy data.

Periodic review of database logs is a detective control that captures records of who accessed the database, what queries were run, and what data was retrieved or exported. Because the employee already has elevated access rights, preventive controls like access reviews would not stop the activity - only log review can surface anomalous copying behavior after it occurs. This directly addresses the scenario of an authorized user abusing their privileges.

Acceptable use policy training is a preventive administrative control and does not detect or surface copying activity that has already occurred.

Employee training on appropriate access usage is also preventive and does not provide visibility into what actions a user with elevated rights has already taken.