HIDS/HIPS/Endpoint Firewalls GMON Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security engineer manages HIPS policies for a mixed environment of Windows and Linux servers. A new zero-day exploit is actively targeting a vulnerability in a widely used web server application. The vendor has not yet released a patch. The engineer needs to implement an immediate mitigation while minimizing operational disruption. The HIPS supports signature-based rules, behavioral analysis, and application control. Which approach best balances protection and availability?

   • AEnable behavioral analysis mode with a strict policy that blocks any process behavior resembling the exploit's post-exploitation activity.
   • BApply an application control rule that prevents the web server process from spawning child processes or writing to system directories.
   • CCreate a custom signature rule that blocks the specific exploit pattern observed in the wild and deploy it to all servers running the web server.
   • DDeploy the custom signature rule to block the observed exploit pattern, and simultaneously enable behavioral analysis in alert-only mode to monitor for exploit variations.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When configuring an endpoint firewall, what is the purpose of creating separate inbound and outbound rules?

   • ATo control traffic in each direction independently, allowing different policies for incoming and outgoing connections
   • BTo simplify the rule set by combining all rules into one list
   • CTo reduce the performance impact of the firewall
   • DTo ensure that all traffic is blocked by default
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a typical data source that a HIDS uses to detect malicious activity on an endpoint?

   • ANetwork packet captures from a span port
   • BSystem logs, file integrity data, and process activity
   • CDNS query logs from the corporate DNS server
   • DFlow records from the core router
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a common best practice when deploying HIDS agents across an enterprise to minimize false positives?

   • ADeploy agents only on servers and not on workstations
   • BUse the same default policy for all endpoints without adjustment
   • CDisable all anomaly-based detection to reduce noise
   • DTune the HIDS rules and thresholds based on the specific applications and usage patterns of each endpoint group
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is configuring endpoint protection for a fleet of Windows workstations that process sensitive financial data. The company requires that a specific legacy accounting application be allowed to communicate only with the internal database server on TCP 1433, while all other outbound traffic from that application must be blocked. The analyst has already deployed a HIDS agent that logs file integrity and process creation events. Which additional control should be implemented to enforce the application-specific network restriction?

   • AConfigure a HIPS policy with an application control rule that allows the accounting application to execute and blocks all other executables.
   • BDeploy a network intrusion prevention system (NIPS) inline at the network perimeter to inspect and allow only SQL traffic to the database server.
   • CEnable the HIDS agent's behavioral analysis module to detect anomalous outbound connections from the accounting application and alert on them.
   • DCreate an endpoint firewall rule that permits outbound TCP 1433 from the accounting application to the database server IP and blocks other outbound traffic from that application.
   Reveal Solution Discussion Select an answer first