A morphed worm carrying a 0-day payload has infiltrated the company network and is now spreading across the organization. The security administrator was able to isolate the worm communication and…

Because the worm is already inside the network, a perimeter firewall rule cannot stop its lateral spread - deploying DENY-TCP-ANY-ANY-445 to the Host-based IPS applies the block directly on each individual endpoint, preventing the worm from leveraging the SMB protocol on TCP 445 to replicate from host to host within the internal network.

Scanning and patching hosts is a valid remediation step but is far too slow during an active, spreading infection and would not contain the worm while the patching process is underway.

A corporate firewall ACL blocks traffic at the network perimeter but cannot prevent the worm from spreading laterally between hosts that are already inside the internal network.

A 0-day payload has no existing antivirus signatures, so forcing a signature update would not detect or remove the worm and provides no effective short-term containment.