A security incident responder discovers an attacker has gained access to a network and has overwritten key system files with backdoor software. The server was reimaged and patched offline.
Which of the following tools should be implemented to detect similar attacks?
A . Vulnerability scanner
B . TPM
C . Host-based firewall
D . File integrity monitor
E . NIPS
Answer: D