A motion detector alarm that alerts security staff about a suspected breach is the correct option.

The motion detector alarm is a classic example of a detective control because it does not block access or prevent the event from occurring and it instead detects anomalous activity and generates an alert so security staff can investigate and respond.

A firewall that blocks unauthorized traffic and prevents network intrusions is incorrect because a firewall is a preventive control that aims to stop unauthorized traffic before it reaches assets rather than to detect and alert on an incident.

A lobby concierge who verifies visitor badges before permitting access is incorrect because that role is a preventive or administrative physical control that gates access at the point of entry instead of detecting and reporting a breach after it happens.

Two factor authentication required at user sign in is incorrect because two factor authentication is a preventive technical control that reduces the chance of unauthorized access rather than serving to detect and alert on suspicious activity.

Full AWS Practitioner Certification Question