MENU
A furniture company recently discovered that the endpoint detection and response configuration flagged several malicious files on company-managed laptops. The company must enhance security to prevent known malicious files from being delivered to the network and endpoints. The new solution must enhance the company's ability to inspect and filter incoming traffic effectively. Which security product must be used to accomplish this goal?
While Endpoint Detection and Response (EDR) is excellent at catching threats that have already reached a device, the objective here is to prevent those files from being delivered in the first place by enhancing the inspection of incoming traffic. A Next-Generation Firewall (NGFW) is the correct architectural choice for this requirement because it operates at the network perimeter (or between segments) and provides deep packet inspection (DPI) far beyond the capabilities of a traditional firewall.
A Cisco Secure Firewall (NGFW) integrates multiple security services into a single platform, including Intrusion Prevention Systems (IPS), Application Visibility and Control (AVC), and Advanced Malware Protection (AMP). When malicious files are sent toward the network, the NGFW can identify them by their signature or behavior and block the transfer before the file ever reaches the internal infrastructure or endpoints. This effectively 'cleans' the traffic stream at the gate.
A traditional firewall (Option B) lacks the application-layer visibility needed to identify malicious file content, as it primarily filters based on IP and port. A host-based firewall (Option C) filters traffic at the individual device level, which is a late-stage defense rather than a network delivery prevention tool. eBPF (Option D) is a high-performance kernel technology used for observability and distributed filtering but is not a standalone 'security product' used for perimeter traffic inspection in this context. Implementing an NGFW aligns with the Cisco SAFE principle of providing a layered defense that blocks threats as far from the critical assets as possible.
========