HIDS/HIPS/Endpoint Firewalls GMON Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary function of a host-based intrusion detection system (HIDS)?

   • ATo scan the entire network for vulnerabilities and misconfigurations
   • BTo automatically block malicious processes before they can execute on the host
   • CTo monitor and analyze activity on a single host to detect suspicious behavior
   • DTo filter and block network traffic at the perimeter of the corporate network
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is investigating a potential breach on a critical server. The analyst needs to determine whether any unauthorized processes have been running and whether any system files have been modified. The server has a HIDS agent installed. Which HIDS capabilities should the analyst use to gather this information?

   • ANetwork traffic capture and endpoint firewall logs.
   • BProcess monitoring logs and file integrity monitoring (FIM) reports.
   • CApplication control logs and HIPS prevention events.
   • DSignature-based detection alerts and anomaly-based detection reports.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is setting up monitoring for a new server that will host a database. The analyst wants to detect if an attacker gains access to the server and attempts to read or modify the database files. The analyst also wants to be alerted if new user accounts are created. Which HIDS capabilities should be enabled?

   • ASignature-based detection for known database exploits and anomaly-based detection for unusual network traffic.
   • BFile integrity monitoring for the database files and log monitoring for user account creation events.
   • CApplication control that restricts which processes can access the database files.
   • DNetwork traffic monitoring and endpoint firewall logging.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary difference between a HIDS and a HIPS?

   • AA HIDS is signature-based, while a HIPS is anomaly-based
   • BA HIDS only monitors file integrity, while a HIPS only monitors network traffic
   • CA HIDS detects and alerts, while a HIPS can actively block malicious activity
   • DA HIDS is installed on the network, while a HIPS is installed on the host
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a key advantage of anomaly-based detection over signature-based detection in a HIDS?

   • AIt is simpler to implement and maintain
   • BIt can detect previously unknown attacks that deviate from normal behavior
   • CIt requires no baseline of normal activity to operate
   • DIt produces fewer false positives than signature-based detection
   Reveal Solution Discussion Select an answer first