Which of the following controls allows a security guard to perform a post-incident review?

Detective controls are designed to identify that an incident has occurred, such as through alarms or monitoring, but do not involve the post-incident review process itself.

Preventive controls aim to stop an incident from happening in the first place, whereas a post-incident review is conducted only after an incident has already occurred.

A post-incident review is a corrective control because it is performed after a security incident has occurred to understand its root cause, assess the impact, and identify actions to prevent similar incidents in the future. This process directly aims to reduce the impact of the incident and improve the organization's security posture, which is the primary objective of a corrective security control.

Deterrent controls are intended to discourage potential attackers from attempting an attack, which is distinct from the reactive and learning nature of a post-incident review.