In which scenario is endpoint-based security the solution?

Inspecting encrypted traffic is typically done by network devices that perform SSL/TLS decryption, not solely by endpoint security, though endpoints might provide visibility into their own decrypted traffic.

Device profiling and authorization are primarily functions of network access control (NAC) systems, which operate at the network edge to identify and control device access, though endpoint agents can contribute data.

Endpoint-based security solutions, such as Endpoint Detection and Response (EDR) or Endpoint Protection Platforms (EPP), are installed directly on individual devices (endpoints) and can monitor processes, files, and network connections. This allows them to perform signature-based application control, blocking or allowing applications based on their known signatures or hashes, which is a direct function of software operating at the endpoint level.

Inspecting a password-protected archive requires the password for decryption, which is generally not a native function of typical endpoint security solutions unless integrated with specific data loss prevention (DLP) or file analysis tools.