Pete, the compliance manager, wants to meet regulations. Pete would like certain ports blocked only on all computers that do credit card transactions. Which of the following should Pete implement to…

A host-based intrusion prevention system monitors and blocks suspicious behavior or known attack signatures, but it is not designed to enforce static port blocking policies on specific machines.

A host-based firewall runs directly on each endpoint and can be configured with rules specific to that machine, enabling port blocking only on the computers designated for credit card processing. This satisfies the PCI-DSS-style requirement to isolate transaction systems without affecting other systems on the network. A network-based firewall would apply rules to all traffic passing through it, making per-host port restrictions impractical without complex segmentation.

An antivirus update system manages malware definitions and has no capability to block network ports on endpoints.

A network-based intrusion detection system passively monitors traffic for anomalies and alerts on them but cannot enforce port blocking, and it operates at the network level rather than targeting individual hosts.