Defensive Security Operations Course Section 1.3

Email Gateway is not considered a correct answer here because it sits upstream from the host and does not directly monitor activity on the host.

The operative phrase here is “detect malware on a computer system”