An intrusion prevention system (IPS) is a security device that monitors network traffic and blocks or modifies malicious packets based on predefined rules or signatures. An IPS can prevent attacks that exploit known vulnerabilities in older browser versions by detecting and dropping the malicious packets before they reach the target system. An IPS can also perform other functions, such as rate limiting, encryption, or redirection. References: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 3: Securing Networks, page 132.

An Intrusion Prevention System (IPS) uses packet inspection (either signature-based, anomaly-based, or both) to analyze network traffic and detect malicious patterns. Configuring packet inspection is the first step to ensure the IPS can identify and respond to specific attack signatures.
Reference:
CompTIA Security+ SY0-701 Official Study Guide, Domain 3.2: "IPS devices must be configured to inspect network packets for attack patterns." Exam Objectives 3.2: "Summarize security implications of embedded and specialized systems."

Detailed Explanation:This scenario highlights the need for training on the secure use of removable media.
Users should learn to avoid using untrusted external storage devices to prevent malware infections. Reference:
CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: "Removable Media Controls and User Awareness Training".

Installing a host-based content filtering solution on the endpoints ensures that web traffic is filtered locally even when the VPN connection to the on-premises proxy fails, maintaining protection for remote users.
Network access control (A) manages device network access, local gateway configuration (B) does not solve protection if VPN fails, and public NAT (C) exposes internal resources and increases risk.
Endpoint filtering complements VPN for resilient web security, covered in Security Architecture and Operations#6:Chapter 11 CompTIA Security+ Study Guide#.

The best answer is A. Zero-day.
A zero-day vulnerability is a newly discovered vulnerability for which no patch or official fix is yet available.
Because defenders have had zero days to fully remediate it, attackers may be able to exploit it before a vendor releases a patch.
The question specifically states that the vulnerability is new and does not have an available patch, which is the defining clue.
Why the other options are incorrect:
B). XSSCross-site scripting is a specific web application attack type, not a description of whether a patch exists.
C). SQLiSQL injection is also a specific attack type, not the broader vulnerability status being asked about.
D). Buffer overflowBuffer overflow is a type of coding flaw, but again it does not specifically describe the condition of having no patch available.
From a Security+ perspective, when a vulnerability is newly identified and lacks a vendor fix, it is best described as a zero-day.