A security engineer is concerned about using an agent on devices that relies completely on defined known-bad
signatures. The security engineer wants to implement a tool with multiple components including the ability to
track, analyze, and monitor devices without reliance on definitions alone. Which of the following solutions best
fits this use case?


A. EDR
B. DLP
C. NGFW
D. HIPS