Matt, an IT administrator, wants to protect a newly built server from zero day attacks. Which of the following would provide the BEST level of protection?

HIPS monitors host-level activity in real time and can block suspicious behaviors based on heuristics and anomaly detection, even when no signature exists for the threat. This behavioral approach makes it the most effective tool against zero-day attacks, which by definition have not yet been cataloged in signature databases.

Antivirus software depends primarily on signature-based detection, making it ineffective against zero-day exploits for which no signature has yet been developed.

A Network Intrusion Detection System (NIDS) monitors network traffic passively and raises alerts but does not block attacks; it also relies on known signatures and cannot prevent host-level zero-day exploits.

Access Control Lists (ACLs) enforce network or file permission rules but have no mechanism to detect or prevent novel exploit code executing on a host.