What defensive measure could have been taken that would have protected the confidentiality of files that were divulged by systems that were compromised by malware?

Ingress filtering at the host level controls inbound network traffic and does not protect the confidentiality of files that are already stored on the compromised host.

Monitoring for abnormal traffic flow is a detective control that may identify an ongoing breach but does not prevent the contents of already-exfiltrated files from being read by an attacker.

File integrity monitoring detects unauthorized modifications to files, addressing integrity rather than confidentiality, and does not prevent an attacker from reading file contents.

Encrypting files locally when not in use (encryption at rest) directly protects confidentiality because the data is rendered unintelligible without the correct decryption key. If malware compromises a system and exfiltrates encrypted files, the attacker obtains only ciphertext, not the underlying sensitive data. This control directly addresses the confidentiality requirement regardless of whether the host or network perimeter is breached.