The correct option is Deploying endpoint anti-malware software.

Deploying endpoint anti-malware software directly blocks, quarantines, and removes malicious files and processes on laptops and servers in real time. It uses signature based scanning and behavioral heuristics and it can be centrally managed so updates and policy enforcement do not rely on users changing their habits. For reducing infections without depending on user behavior this endpoint level prevention is the most effective control.

Enforcing strict network firewall rules is useful for limiting network traffic and reducing some network based threats but it cannot reliably stop malware that arrives on removable media or through user downloads or encrypted channels and it does not provide file and process level blocking on the endpoint.

Implementing endpoint detection and response solutions improves visibility and enables rapid detection, investigation, and containment after suspicious activity is observed but EDR is primarily focused on detection and response rather than the immediate prevention that anti-malware provides. Many EDR products augment prevention but the exam answer favors direct endpoint anti malware for preventing infections.

Regularly applying system and application updates reduces attack surface and prevents exploitation of known vulnerabilities but patching alone will not reliably stop malware that users download or open from attachments and it requires time and operational effort to deploy across all devices.

Full AWS Practitioner Certification Question