The correct answer is Preventive controls.

Preventive controls are measures put in place to stop unauthorized actions before they occur and that is exactly the purpose of next generation firewalls. Firewalls enforce access policies and block malicious traffic at the network boundary so they function to prevent access rather than merely record it.

A network intrusion detection system can be used to detect suspicious activity so it is often associated with detection, but when the combined deployment is focused on stopping unauthorized access the overall control strategy is still preventive controls. In many environments the detection component is paired with inline blocking or response so the effect is to prevent successful compromise.

Detective controls are not the best choice because they are primarily designed to identify and alert on events after or while they are happening rather than to block them. If the question emphasized only logging and alerting then Detective controls would be correct, but the scenario describes stopping unauthorized access.

Corrective controls are intended to restore systems to a secure state after an incident and to fix problems that allowed the incident to occur. Examples include patching, recovery procedures, and configuration changes. Firewalls and similar blocking devices do not primarily perform corrective functions.

Directive controls are policies, standards, and procedures that guide user and administrator behavior. They do not themselves block network traffic or prevent access so they are not the right classification for firewall and intrusion devices.

Full AWS Practitioner Certification Question