HIDS/HIPS/Endpoint Firewalls GMON Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which statement best describes the role of a HIPS in endpoint security?

   • AIt actively blocks malicious actions on the host, such as unauthorized process execution or file modifications
   • BIt scans the host for vulnerabilities and reports them to a central console
   • CIt passively monitors host activity and generates alerts for the security team
   • DIt filters network traffic between the host and the internet
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company has deployed a HIDS agent on 500 servers. The security team is receiving thousands of alerts daily for a legitimate internal application that frequently modifies its own configuration files and writes to temporary directories. The alerts are overwhelming the monitoring team and causing them to miss critical events. The application cannot be modified or replaced. What is the most effective approach to reduce the alert noise while preserving visibility into genuinely suspicious activity?

   • ADisable the file integrity monitoring module on all servers running the application.
   • BConfigure the HIDS agent to send alerts to a separate email address that the team checks weekly.
   • CIncrease the alert severity threshold to 'high' so that only critical file changes generate alerts.
   • DCreate a HIDS policy exception that suppresses alerts for the specific file paths, processes, and write patterns associated with the legitimate application.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary function of an endpoint firewall?

   • ATo prevent unauthorized applications from executing
   • BTo filter network traffic to and from the host based on predefined rules
   • CTo encrypt data stored on the host
   • DTo detect and alert on malicious activity on the host
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a key reason to regularly update HIPS policies and rules?

   • ATo comply with licensing requirements
   • BTo reduce the performance impact of the HIPS agent
   • CTo eliminate the need for signature updates
   • DTo adapt to new threats and changes in the endpoint environment
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which HIDS detection method compares observed activity against a predefined database of known attack patterns?

   • ABehavioral detection
   • BHeuristic detection
   • CSignature-based detection
   • DAnomaly-based detection
   Reveal Solution Discussion Select an answer first