Several recent ransomware outbreaks at a company have cost a significant amount of lost revenue. The security team needs to find a technical control mechanism that will meet the following…

A host-based firewall filters network traffic by port and protocol but has no capability to analyze or block malicious software behavior on the endpoint.

EDR is primarily focused on detection, investigation, and response after a threat is identified, not on proactively blocking unknown threats before they execute.

HIPS monitors system-level activity and blocks actions that match suspicious behavioral patterns - such as mass file encryption typical of ransomware - without requiring a known signature. This allows it to protect against previously unknown (zero-day) threats in real time. It also augments existing security controls like antivirus by adding a behavior-based prevention layer.

Patch management reduces the attack surface by remediating known vulnerabilities but cannot detect or block behaviorally unknown or signature-less malware.