A company has engaged a penetration tester to perform an assessment for an application that resides in the company's DMZ. Prior to conducting testing, in which of the following solutions should the…

A WAF operates at the HTTP/HTTPS application layer and only inspects web request traffic, so it does not monitor all network-level scanning or non-HTTP exploit traffic that a penetration tester generates across the DMZ.

A HIDS monitors activity only on the individual host on which it is installed and does not inspect inbound network traffic at the perimeter before it reaches the target system.

A NIDS monitors all network traffic traversing the DMZ and uses signature-based detection to identify and alert on port scans, exploit payloads, and other offensive traffic patterns. Whitelisting the penetration tester's source IP ensures the NIDS does not suppress or generate alerts on authorized test traffic, allowing the assessment to proceed without interference from automated blocking or incident response triggers.

A DLP solution monitors data transfers for policy violations such as sensitive data exfiltration and is not designed to detect or block inbound network scanning or exploitation traffic from external sources.