In an IaaS environment, the security team issues a new signature file to prevent specific malware threats from infiltrating the company network. Which of the following describes where the security tea

An IDS is a passive monitoring tool that only detects and alerts on threats without actively blocking traffic, so it cannot prevent malware from infiltrating the network.

A spam filter is designed to filter unsolicited or malicious email messages and does not inspect or block general network traffic carrying malware payloads.

A Web Application Firewall uses signature-based detection rules to identify and block known malicious traffic patterns targeting web applications in an IaaS environment. Deploying updated signature files to the WAF ensures that specific malware threats delivered via web-based vectors are identified and dropped at the perimeter before they can infiltrate the internal network. WAFs are commonly deployed in IaaS as virtual appliances or cloud-native services to protect public-facing workloads.

A NIPS operates at the network layer using signatures but is not the primary signature-based control deployed in IaaS environments specifically for inspecting and blocking web-application-layer malware threats.

A HIPS operates at the individual host level to protect a single endpoint rather than at the network perimeter where infiltrating traffic would first arrive.