Antivirus is commonly associated with endpoint security because it protects user devices and hosts from known malicious software. It scans files, applications, and sometimes active processes for malware signatures or suspicious behavior. Endpoint security controls are deployed on or near devices such as laptops, desktops, mobile devices, and servers. Syslog is a logging protocol used to transmit events to collectors and is more closely associated with security operations. A virtual machine is a cloud or virtualization concept and may be protected by endpoint tools, but it is not itself an endpoint security component. DLP can protect data on endpoints, networks, and cloud services, but in the course objective structure, antivirus is the clearest endpoint security component. Endpoint security is critical because endpoints are where users interact with applications, open files, browse websites, and authenticate to services. They are often the first point of compromise and the last line of defense. Reference/topics: Endpoint Security 4.3, antivirus; Endpoint Security 4.2, endpoint security objectives.