Which protection technology can detect botnet command and control traffic generated on the Symantec Endpoint...

Intrusion Preventionis the protection technology within Symantec Endpoint Protection that can detectbotnet command and control (C&C) traffic. By analyzing network traffic patterns and identifying knownC&C communication characteristics, Intrusion Prevention can block suspicious network connections indicative of botnet activity.

How Intrusion Prevention Detects Botnet Traffic:

Intrusion Prevention monitors outbound and inbound traffic for signatures associated with botnet C&C protocols.

It can block connections to known malicious IPs or domains, effectively disrupting the communication between the botnet client and its controller.

Why Other Options Are Incorrect:

Insight(Option A) focuses on file reputation rather than network traffic.

SONAR(Option B) detects behavior-based threats on the endpoint but not specifically C&C traffic.

Risk Tracer(Option C) identifies the source of detected threats but does not directly detect botnet network traffic.

References: Intrusion Prevention is a key component in detecting and blocking botnet C&C traffic, preventing compromised endpoints from communicating with attackers​.