Which of the following controls would BEST help to detect a targeted attack exploiting a zero-day vulnerability?

An IPS primarily relies on known signatures or behavioral patterns to block attacks, making it ineffective against truly novel zero-day vulnerabilities.

Vulnerability scanning identifies known weaknesses in systems, but it cannot detect a zero-day vulnerability that is not yet publicly known or patched.

EDR provides advanced detection on endpoints but lacks the broader network, cloud, and email context that XDR offers, which is crucial for detecting complex, multi-stage zero-day attacks.

Extended Detection and Response (XDR) offers the best chance to detect a zero-day exploit because it correlates telemetry from endpoints, networks, cloud, and email, providing a much broader context and analytical capability than other solutions. This cross-domain visibility allows XDR to identify sophisticated attack patterns, lateral movement, or anomalous behavior that single-point solutions might miss, even without a known signature.