Which term refers to the agent software that prevents malware and detects activity on endpoints?

• A. Endpoint Detection and Response (EDR)
• B. Endpoint Protection Platform (EPP)
• C. Signature File Detection
• D. Telemetry Events

Answer: (B)

An Endpoint Protection Platform is the software agent installed on endpoints that provides prevention against malware and ongoing detection. It combines protective features like antivirus, anti-malware, exploit protection, firewall, and sometimes device control to block threats before they execute, while also monitoring for suspicious activity to detect potential attacks. This makes it the best fit for the description of software that both prevents malware and detects activity on endpoints.

Endpoint Detection and Response focuses more on detecting and investigating threats and guiding responses after an incident, rather than being the primary preventive agent. Telemetry events are the data endpoints send about their activity, not the protective software itself. Signature File Detection is one method used for detection, not the overall platform.