Host based watchdogs file integrity monitoring and anti malware agents is correct.

Host based watchdogs operate on the server and endpoint so they can detect suspicious local processes and service behavior that network devices cannot see. File integrity monitoring watches critical system files configurations and application files for unauthorized changes and it raises alerts when tampering occurs. Anti malware agents detect block and remove malicious software and they prevent or reduce the impact of malware that would otherwise modify files or create backdoors. Together these host focused controls address unauthorized access file tampering and malware on both servers and user devices.

Firewalls and intrusion detection systems focus on network traffic and perimeter defenses and they do not directly monitor or protect local files and processes on servers and endpoints. They can limit exposure but they do not provide file integrity checks or endpoint malware removal.

Endpoint detection and response and application whitelisting can be valuable and EDR provides strong detection and investigation capabilities while whitelisting prevents unknown applications from running. This option is not the best match here because the question specifically emphasizes detecting and preventing file tampering and simple host based file integrity monitoring plus anti malware agents more directly address both tampering and malware removal needs.

Encryption and public key infrastructure protect confidentiality and help ensure data authenticity in transit and at rest but they do not prevent malware execution or detect unauthorized changes to system and application files on servers and user devices.

Full AWS Practitioner Certification Question