Question 17

EDR would prevent the malicious file from downloading.

Endpoint Detection and Response (EDR) solutions are designed to monitor and respond to threats on endpoints, such as computers. In this scenario, EDR would actively detect the malicious file and prevent it from being downloaded, protecting the employee's computer from potential harm.

A) DLP

Data Loss Prevention (DLP) tools primarily focus on preventing sensitive information from leaving the organization. While they can block certain types of data transfers, they are not specifically designed to prevent the downloading of malicious files, making them ineffective in this context.

B) FIM

File Integrity Monitoring (FIM) is used to detect unauthorized changes to files and configurations on a system. Although it can alert administrators to changes that may indicate a security breach, it does not actively prevent downloads of malicious files, rendering it unsuitable for this situation.

C) NAC

Network Access Control (NAC) is aimed at enforcing security policies on devices attempting to access a network. While NAC can restrict access based on compliance with security standards, it does not specifically prevent the download of malicious files once a device is connected, limiting its effectiveness in this scenario.

D) EDR

Endpoint Detection and Response (EDR) solutions are specifically designed to identify and respond to threats on endpoints. They can monitor for suspicious activities, including the downloading of malicious files, and take immediate action to block such activities, making them the most effective option in this context.

Conclusion

EDR is the most suitable option for preventing the download of malicious files as it actively monitors and responds to threats in real-time. In contrast, DLP, FIM, and NAC focus on different aspects of security and do not provide the necessary protection against the specific threat posed by malicious downloads. Thus, EDR stands out as the definitive solution for this scenario.