A security architect is responsible for the protection of a new home banking system. Which of the following solutions can BEST improve the confidentiality and integrity of this external system?

An IPS primarily focuses on detecting and blocking network-level attacks and intrusions, but it does not directly address user authentication or ensure confidentiality and integrity of the application data at the user level.

A DoS protection solution focuses on maintaining availability of the system by mitigating volumetric and application-layer denial-of-service attacks, but it does not address confidentiality or integrity.

An OTP token provides strong two-factor authentication, ensuring that only authorized users can access the banking system, which directly protects both confidentiality (preventing unauthorized viewing of account data) and integrity (preventing unauthorized modifications to transactions). OTPs are single-use and time-limited, making them resistant to replay attacks and credential theft. For an external-facing banking system, strong authentication is the most fundamental control to protect both confidentiality and integrity simultaneously.

A WAF protects against web application attacks such as SQL injection and cross-site scripting, primarily addressing integrity and availability, but it does not comprehensively address confidentiality through user authentication the way an OTP token does.