A cloud administrator is securing an application hosted by an IaaS provider. The operating system on the VM has been updated. Which of the following should the administrator use to BEST secure the…

A firewall primarily controls network access by blocking specific ports or IP addresses and does not analyze application-level attacks or exploits against vulnerable services themselves.

Antivirus software protects against known malware files and processes on the host but is not designed to detect network-based attacks against services or exploit attempts regardless of the OS.

An Intrusion Detection System (IDS) actively monitors network traffic or system logs for suspicious activities, known attack signatures, or anomalies that could indicate an attempted compromise against vulnerable services. This provides a deeper layer of security by analyzing the content and behavior of interactions, offering protection even when OS-level vulnerabilities exist or other controls are bypassed.

Patch management fixes vulnerabilities by updating the OS and applications, but it is a proactive measure; an IDS is a reactive/detective control for actual attacks against services that might still be vulnerable or subject to zero-day exploits.