Which component monitors and responds to endpoint threats?

• A. Antivirus Protection
• B. Endpoint Detection and Response
• C. Firewall Protection
• D. Device Control

Answer: (B)

Monitoring and responding to threats on endpoints happens continuously, with the tool watching for signs of compromise across devices, collecting data, and using analytics to detect both known and unknown attacks. When a threat is detected, it can automatically contain the issue—isolating the device, stopping malicious processes, and quarantining or removing malicious files—while providing investigators with details to understand what happened. This real-time detection and rapid response across multiple endpoints is what sets this capability apart from traditional antivirus, which relies mainly on known signatures and can miss newer or stealthy threats. Firewall protection focuses on controlling network traffic rather than monitoring endpoint behavior, and device control manages hardware access rather than threat detection and remediation.