Security incident and event management systems is the correct option.

Security incident and event management systems are detective controls because they collect, aggregate, and correlate logs and events from multiple sources and generate alerts when anomalous or malicious activity is observed.

Security incident and event management systems provide continuous monitoring, alerting, and forensic data that enable security teams to detect incidents in progress or discover them after they occur, which is the primary purpose of detective controls.

Identity and access management controls are not detective because they are primarily preventive and they focus on controlling who can access resources and what actions they can perform.

Backup and restore procedures are not detective because they are corrective controls used to recover data and systems after an incident rather than to detect that an incident is occurring.

Encryption of data at rest and in transit is not detective because it is a preventive control that protects confidentiality and integrity by making data unreadable to unauthorized parties rather than by detecting security events.

Full AWS Practitioner Certification Question