A suspicious process persists after a user closes its visible window. Which capability assists investigation and containment?

1. An authoritative DNS zone
2. An unmanaged Ethernet hub
3. Endpoint detection and response
4. A passive patch panel