A security administrator is trying to eradicate a worm, which is spreading throughout the organization, using an old remote vulnerability in the SMB protocol. The worm uses Nmap to identify target hos

A host-based firewall primarily protects individual endpoints and, while it could block SMB, it lacks the centralized network visibility and advanced threat detection capabilities required for widespread eradication and comprehensive zero-day prevention across an entire organization.

An enterprise patch management system is effective for fixing known vulnerabilities but is inherently unable to prevent or eradicate zero-day attacks, as these exploits have no available patches at the time of the attack.

A Network-based Intrusion Prevention System (NIPS) monitors network traffic in real-time, detecting and blocking malicious activity like Nmap scans and SMB exploits before they reach target hosts. Its advanced capabilities, often including behavioral analysis and anomaly detection, allow it to identify and mitigate future attacks, including zero-day vulnerabilities, by recognizing suspicious patterns and deviations from normal network behavior even without specific signatures.

Application blacklisting prevents specific unauthorized applications from executing on endpoints but does not address the network-based exploitation vector of the worm or proactively prevent zero-day attacks at the network layer.

File integrity checking detects unauthorized changes to files after a system has already been compromised and thus cannot prevent the initial network-based exploitation or actively stop the spread of a worm or zero-day attack.