Which of the following is the BEST network defense against unknown types of attacks or stealth attacks in progress?

IPS relies primarily on known attack signatures and rule-based detection, making it ineffective against zero-day or unknown attacks that do not match any existing signature patterns.

IDS, like IPS, depends heavily on signature-based detection to identify threats, so it will fail to alert on unknown attack types or stealth attacks that do not match predefined signatures.

Stateful firewalls track connection states and enforce access control policies based on ports and protocols, but they do not analyze behavioral anomalies and cannot detect unknown or stealth attacks embedded in legitimate-looking traffic.

NBA tools monitor traffic flows and establish behavioral baselines, detecting deviations that indicate unknown or zero-day attacks, insider threats, and stealthy intrusions without relying on known attack signatures. Unlike signature-based systems, NBA can identify novel attack vectors by recognizing abnormal communication patterns, unusual data volumes, or unexpected protocol usage. This anomaly-based approach makes NBA uniquely suited for defending against threats that have no existing signatures or that deliberately evade detection.