Intrusion Preventionis the protection technology within Symantec Endpoint Protection that can detectbotnet command and control (C&C) traffic. By analyzing network traffic patterns and identifying knownC&C communication characteristics, Intrusion Prevention can block suspicious network connections indicative of botnet activity.
* How Intrusion Prevention Detects Botnet Traffic:
* Intrusion Prevention monitors outbound and inbound traffic for signatures associated with botnet C&C protocols.
* It can block connections to known malicious IPs or domains, effectively disrupting the communication between the botnet client and its controller.
* Why Other Options Are Incorrect:
* Insight(Option A) focuses on file reputation rather than network traffic.
* SONAR(Option B) detects behavior-based threats on the endpoint but not specifically C&C traffic.
* Risk Tracer(Option C) identifies the source of detected threats but does not directly detect botnet network traffic.
References: Intrusion Prevention is a key component in detecting and blocking botnet C&C traffic, preventing compromised endpoints from communicating with attackers.