HIDS/HIPS/Endpoint Firewalls GMON Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security manager is comparing HIDS and HIPS for a new deployment. The manager's primary concern is preventing ransomware from encrypting files on endpoints. The organization already has a SIEM that collects and correlates logs from various sources. Which solution should the manager choose to directly address the ransomware threat?

   • AHIDS with file integrity monitoring and alerting.
   • BHIPS with behavioral analysis that blocks mass file encryption and suspicious process behavior.
   • CAn endpoint firewall that blocks inbound connections from the internet.
   • DA SIEM rule that correlates file changes and alerts the security team.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security administrator is deploying a HIDS agent to a fleet of Linux servers. The administrator wants to minimize false positives while ensuring that common attack techniques are detected. The HIDS supports signature-based, anomaly-based, and behavioral detection. What is the most appropriate initial configuration?

   • AEnable all detection methods at their most sensitive settings to ensure maximum coverage.
   • BEnable signature-based detection with a baseline of normal system behavior, and tune anomaly thresholds after a learning period.
   • CEnable only behavioral detection to focus on process and file system activity.
   • DEnable only anomaly-based detection to catch unknown threats and avoid signature updates.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a common method for centrally monitoring HIDS/HIPS and endpoint firewall events across an enterprise?

   • AForwarding events to a centralized SIEM or log management platform
   • BUsing a network analyzer to capture all endpoint traffic
   • CDisabling alerts and relying on periodic manual scans
   • DReviewing logs locally on each endpoint
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When responding to a HIDS alert, what is an appropriate first step?

   • AIgnore the alert if it is from a low-priority endpoint
   • BReinstall the operating system on the endpoint
   • CVerify the alert by checking the endpoint's logs and correlating with other sources
   • DImmediately disconnect the endpoint from the network
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is deploying a HIPS solution to its engineering workstations. The engineering team frequently compiles code and runs custom-built tools that are not signed by a trusted publisher. The security team wants to prevent unauthorized executables from running while minimizing disruption to the engineering workflow. What is the most effective HIPS configuration approach?

   • AEnable signature-based detection for known malware and rely on behavioral analysis for unknown threats.
   • BEnable application control with a policy that allows executables from specific trusted folders and blocks all others.
   • CSet the HIPS to block all executables that are not signed by a trusted publisher.
   • DConfigure the HIPS to prompt the user for permission whenever an unsigned executable attempts to run.
   Reveal Solution Discussion Select an answer first