A security team's primary requirement is to stop known malware from running on workstations at all, by checking files when they are written or executed and blocking or quarantining any with a known malicious disposition. Which category of solution is built for this?
Select an answer to reveal the explanation.
Short Explanation
If the goal is "never let it run," you want the bouncer, not the detective. An EPP checks files as they land or launch and blocks the known bad ones right there. A SIEM or an IDS can tell you something happened, but they're not standing at the door of each workstation.
Full Explanation
An Endpoint Protection Platform is the prevention layer on the host. It inspects files on write, copy and execution, compares them with known-malicious signatures, hashes and cloud dispositions, and blocks or quarantines matches before they can run. That directly satisfies a requirement to keep known malware from executing at all. EDR complements EPP by recording behavior for detection and investigation, but prevention at execution is the defining EPP function. A SIEM collects and correlates logs from many sources to detect patterns; it does not sit in the execution path of a workstation and cannot block a file as it launches. MDM enforces configuration and compliance on managed devices, such as passcodes, encryption and app distribution, and is not a malware inspection engine. A network IDS observes traffic passively out of band and generates alerts; being passive, it cannot stop anything, and it never sees a file that arrives by USB or encrypted channels. Exam caveat: products such as Cisco Secure Endpoint combine EPP and EDR in one agent, so read the question for whether it asks about prevention or about investigation. Operational check: copy a harmless test file with a known malicious disposition to a workstation and confirm that it is quarantined and an event is recorded.