💡 A. A list of trustworthy, good traffic and a list of unauthorized, blocked traffic: This describes whitelisting and blacklisting, which are preventive controls that block unauthorized traffic before a threat occurs, rather than detecting an attack in progress. B. Monitoring for vulnerabilities based on industry intelligence: This is the correct answer. A detective control identifies potential threats after they have emerged. Monitoring vulnerabilities using industry intelligence helps detect new cyber risks, attack patterns, and system weaknesses, allowing organizations to respond accordingly. C. Comprehensive service level agreements with vendors: Service level agreements (SLAs) help ensure vendors meet security expectations, but they are not a detective control. They are more related to governance and preventive measures. D. Firewall and other network perimeter protection tools: Firewalls and perimeter security tools act as preventive controls, stopping threats before they reach internal systems. Detective controls focus on identifying and alerting the organization after a potential security event has occurred.