HIDS/HIPS/Endpoint Firewalls GMON Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is deploying HIDS agents to a large number of endpoints across multiple departments. The team wants to ensure that the HIDS configuration is consistent across all endpoints while allowing for department-specific exceptions. The deployment must be completed quickly and with minimal manual effort. Which approach best meets these requirements?

   • ADeploy the HIDS agent with default settings and rely on the vendor's cloud service to update policies automatically.
   • BManually configure each endpoint with the same HIDS policy and then adjust settings individually as needed.
   • CCreate a single HIDS policy for all endpoints and disable alerts for any department that reports false positives.
   • DUse a centralized management console to deploy a baseline HIDS policy to all endpoints and then apply department-specific policy overrides.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which HIPS prevention mechanism uses a database of known malicious patterns to block threats?

   • ASignature matching
   • BNetwork filtering
   • CBehavioral analysis
   • DApplication control
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security operations center (SOC) is overwhelmed by alerts from its HIDS, HIPS, and endpoint firewall solutions. The SOC manager wants to reduce alert fatigue while ensuring that high-priority incidents are not missed. The team has limited staffing and cannot manually review every alert. Which strategy is most effective for improving the SOC's ability to identify and respond to genuine threats?

   • ADeploy a SIEM platform to aggregate and correlate events from HIDS, HIPS, and endpoint firewalls, and create rules that generate alerts only for correlated patterns.
   • BConfigure the HIDS, HIPS, and endpoint firewall to send all alerts directly to the SOC's email distribution list for manual review.
   • CDisable alerts from the endpoint firewall because the HIDS and HIPS already provide sufficient coverage.
   • DIncrease the severity threshold for all alerts so that only critical events are sent to the SOC.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When creating HIPS rules, what is a best practice to avoid disrupting legitimate applications?

   • ATest rules in a staging environment before deploying to production
   • BSet all rules to block mode immediately
   • CUse the same rules for all endpoints regardless of their role
   • DDisable logging for the rules to reduce noise
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is evaluating whether to replace an existing HIDS deployment with a HIPS solution on a set of internet-facing web servers. The current HIDS has been generating alerts about suspicious outbound connections and unauthorized file modifications. The analyst's primary concern is reducing the time to respond to active intrusions. Which capability of HIPS directly addresses this concern?

   • AHIPS can correlate alerts from multiple endpoints to identify coordinated attack campaigns.
   • BHIPS can automatically block malicious processes and network connections in real time based on its analysis.
   • CHIPS can log detailed forensic information about process execution and file access for post-incident analysis.
   • DHIPS can generate compliance reports that demonstrate the organization's security posture to auditors.
   Reveal Solution Discussion Select an answer first