A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs…

Application whitelisting/blacklisting - implemented via tools like Microsoft AppLocker or Windows Defender Application Control - operates directly on the endpoint to allow or deny execution of specific applications by name, path, publisher, or hash, giving management precise control over what can run on every corporate PC.

A network NGFW controls traffic flows between network segments but cannot enforce which applications a user installs or executes locally on a host.

A host-based IDS monitors and alerts on suspicious activity but does not enforce application execution policies or block specific programs from running.

Antivirus/antispyware software targets known malicious code signatures and behaviors, not the policy-based blocking of legitimate but unwanted business applications.