Network intrusion detection system is the correct option.

Network intrusion detection system monitors network traffic at strategic points and analyzes packets and flows to identify malicious patterns and anomalies. It is deployed at network chokepoints and aggregation points so it can observe traffic from many hosts and detect coordinated or lateral attacks across the enterprise. Because it focuses on observing and alerting on suspicious activity across the network it is the most effective choice for detecting malicious activity by monitoring enterprise traffic.

Firewall enforces access control rules and filters traffic based on addresses and ports. It is primarily designed to permit or block connections and it does not provide the broad packet inspection and detection capability across multiple network segments that a network intrusion detection system provides.

Intrusion prevention system can detect threats and it is often placed inline to block or prevent malicious traffic. The question emphasizes detection by monitoring the enterprise network which aligns with the passive monitoring role of a network intrusion detection system rather than the active prevention role of an IPS.

Host intrusion detection system runs on individual endpoints and monitors local events such as file integrity and system calls. It cannot observe traffic across the entire network so it is not suitable for detecting network-wide malicious activity.

Full AWS Practitioner Certification Question