A company that has been breached multiple times is looking to protect cardholder data. The previous undetected attacks all mimicked normal administrative-type behavior. The company must deploy a…

Antivirus relies on signature matching and cannot detect attacks that mimic legitimate administrative behavior or block hashes of files not in its database.

EDR detects administrative-style attack behaviors through continuous behavioral monitoring, can block execution of files matching specific MD5 hashes, and generates alerts on suspicious activity - satisfying three of the four requirements.

A HIDS (Host Intrusion Detection System) monitors and logs suspicious activity but only detects - it does not block hash execution or prevent data exfiltration.

DLP (Data Loss Prevention) inspects and controls data in motion, at rest, and in use, specifically preventing the exfiltration of sensitive data such as cardholder data - satisfying the fourth requirement that EDR alone cannot fulfill.

A HIPS focuses on blocking known attack patterns via rules; it lacks the behavioral analytics of EDR and does not provide DLP capabilities to stop data exfiltration.

EFS (Encrypting File System) encrypts files at rest to prevent unauthorized access to stored data; it provides no detection, alerting, or exfiltration prevention capabilities.