The correct answer is Conducting routine security audits and reviewing system logs.

Conducting routine security audits and reviewing system logs is a classic detective control because it focuses on identifying and confirming security events after they occur. Routine audits and log reviews allow security teams to detect anomalies, correlate events, and produce evidence that supports incident investigation and response. These activities are part of monitoring and logging processes and they generate alerts and findings rather than directly preventing access or data exposure.

Google Cloud Armor is not primarily a detective control. It is a service that provides web application firewall and DDoS mitigation and its main role is to block or mitigate malicious traffic at the edge. While it can produce logs that support detection, its primary function is preventative protection rather than detection.

Encrypting sensitive data at rest is not a detective control. Encryption protects confidentiality by making stored data unreadable to unauthorized parties and it is a preventive measure that reduces the impact of data exposure. It does not by itself detect or alert on suspicious activity.

Requiring multi factor authentication for user logins is also not a detective control. MFA is an access control that prevents unauthorized logins by requiring additional verification steps. It helps stop unauthorized access but it does not perform monitoring or detection, although authentication logs may later be reviewed as part of detective activities.

Full AWS Practitioner Certification Question