HIDS/HIPS/Endpoint Firewalls GMON Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security engineer is managing HIPS policies for a large enterprise. A recent update to a legitimate software package is causing the HIPS to block the software's installer from running, which is disrupting business operations. The engineer needs to resolve the issue quickly while maintaining security. The HIPS uses signature-based detection and application control. What is the most appropriate action?

   • AReconfigure the HIPS to use alert-only mode for all signature-based rules.
   • BDisable the HIPS agent on all affected endpoints until the software installation is complete.
   • CCreate a temporary HIPS policy exception that allows the specific installer executable to run, and then remove the exception after the installation is verified.
   • DUpdate the HIPS signature database to the latest version and assume the issue will be resolved.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is an example of an application-based rule in an endpoint firewall?

   • ABlock all inbound traffic from a specific IP address
   • BAllow the web browser to access the internet, but block other applications
   • CLog all traffic that matches a specific protocol
   • DAllow all traffic on port 80 from any IP address
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team has deployed a HIDS agent on a set of development workstations. The team wants to detect a known malware family that modifies specific registry keys and creates files with a distinctive naming pattern. The malware is well-documented, and its indicators of compromise (IOCs) are widely published. Which HIDS detection method is most appropriate for this requirement?

   • ASignature-based detection using rules that match the specific registry key changes and file naming patterns associated with the malware.
   • BA combination of anomaly-based and behavioral detection to catch both known and unknown variations of the malware.
   • CBehavioral detection that monitors for processes attempting to modify registry keys and create files in unusual locations.
   • DAnomaly-based detection that establishes a baseline of normal registry and file activity on each workstation.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security administrator is configuring a HIPS on a Windows server that runs a database application. The application is known to spawn a child process that performs routine maintenance tasks. The HIPS has a rule that blocks the creation of new processes by the database application. The administrator wants to allow the maintenance task while still blocking other unauthorized process creations. What is the most appropriate action?

   • ADisable the HIPS rule and rely on the HIDS to detect any unauthorized process creations.
   • BRemove the rule that blocks process creation by the database application.
   • CModify the rule to block all process creations except those initiated by the maintenance task.
   • DCreate an exception rule that allows the specific maintenance process to be created by the database application.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a key consideration when configuring HIDS agents on endpoints?

   • AConfiguring the agent to block all inbound traffic by default
   • BEnsuring the agent has network access to the management server for policy updates and alert reporting
   • CInstalling the agent only on endpoints with static IP addresses
   • DDisabling the agent's logging to reduce disk usage
   Reveal Solution Discussion Select an answer first