An intrusion detection system (IDS) is specifically designed for monitoring network traffic and identifying suspicious patterns that may indicate a cybersecurity threat. When an IDS detects potential malicious activity, it alerts security teams, making it the best detective control from the listed options. Although a network tap provides the means to monitor network traffic, it does so without the analysis or alerting capabilities intrinsic to an IDS. Security logs, while useful, typically require active review and analysis and do not inherently alert teams to incidents. White-box testing is a methodology used in the development phase to test internal structures or workings of an application, rather than functioning as a continuous detective control.