A public health clinic wants an appliance that inspects traffic and can block malicious flows aimed at public-health portals, not merely forward packets by destination IP. Which component best matches that need?
Select an answer to reveal the explanation.
Short Explanation
A plain router is like a traffic cop who only checks street names. An NGFW or IPS actually looks inside the car and can stop the bad stuff. Public-health portals need that inspection layer, not just IP forwarding.
Full Explanation
Public-health portals facing the Internet need more than destination-IP forwarding: they need inspection that can identify and block malicious flows. A next-generation firewall or IPS matches that requirement by examining traffic beyond simple routing—using application awareness, signatures, behavioral detection, or similar controls—and then allowing or denying based on threat posture. For a clinic protecting citizen-facing health systems, that inspect-and-block capability is the component that directly addresses malicious flows rather than merely shipping packets toward a destination.
A basic packet-forwarding router with no deep threat inspection features fails because routing decides next hop by destination (and related forwarding state); it does not substitute for NGFW/IPS inspection and blocking of malicious content or sessions. An unmanaged hub that repeats bits to every connected port fails by concept—it is a shared Layer 1/2 repeater with no security policy engine. A copper patch panel that only terminates cabling in the closet fails because it is passive physical infrastructure; it neither inspects nor blocks traffic.
Exam caveat: Do not equate "firewall" with "router" on stems that emphasize inspection and blocking of malicious flows. CCNA network-component questions often contrast forwarding devices with security appliances; pick the role that matches the verb in the stem (inspect/block vs forward).
Operational check: Place the NGFW/IPS inline (or in an inspected path) for traffic to the public-health portals, enable the relevant threat policies, and verify that benign portal sessions succeed while known-bad or policy-violating flows are logged and blocked. If the only device in path is a basic router with ACLs limited to L3/L4 and no threat inspection, the clinic still lacks the appliance role the design asked for.