A security analyst is reviewing the following event: The packet appears to contain a malicious payload that is being delivered to the endpoint through the gateway firewall. Which of the following…

A NIPS sits inline on the network and performs deep packet inspection to detect and drop packets containing malicious payloads in real time, stopping the attack at the gateway before it reaches the endpoint. Because the packet was already passing through the gateway firewall, a NIPS positioned at or behind the gateway provides the additional layer needed to inspect content and block threats. This directly mitigates the described attack vector of payload delivery through the perimeter.

A Host-based IDS monitors activity on individual endpoints after traffic has already been delivered - it detects but does not block malicious packets traversing the network.

Antivirus operates on files at the host level after they have been received and written to disk, providing no protection against the network-level delivery of the malicious payload.

A SIEM aggregates and correlates security events for alerting and analysis but has no capability to actively block or drop malicious network traffic in transit.