A city CISO notices staff calling every firewall rule 'detective.' Which statement correctly contrasts a blocking firewall rule with a SIEM alert that only notifies after traffic has already occurred?

Preventive controls stop or reduce the likelihood of an unwanted action before it succeeds; detective controls identify and alert after activity occurs or while it is observable. A firewall rule that drops unauthorized traffic is preventive because it blocks the action. A SIEM alert that only notifies after matching events appear in logs is detective. Later analyst response may lead to corrective steps, but the alert itself does not reclassify the control as preventive.