HIDS/HIPS/Endpoint Firewalls GMON Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security engineer is configuring HIPS on a set of servers that run a critical application. The application is known to use a specific DLL that is also used by a known malware family. The HIPS has a signature that flags the DLL as malicious. The engineer needs to allow the legitimate application to run while still protecting against the malware. Which action is most appropriate?

   • ADisable the signature that flags the DLL as malicious.
   • BRename the DLL used by the legitimate application so it does not match the malware signature.
   • CSwitch the HIPS to alert-only mode for all signatures.
   • DCreate a HIPS policy exception that allows the specific legitimate application to load the DLL while keeping the signature active for other processes.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which scenario best illustrates the benefit of integrating HIDS, HIPS, and endpoint firewall on a single endpoint?

   • AThe firewall blocks a malicious connection, the HIPS prevents the malware from executing, and the HIDS alerts on the attempted file modification
   • BThe HIPS replaces the firewall and the HIDS is optional
   • CThe firewall logs all activity, the HIDS filters traffic, and the HIPS provides alerts
   • DThe HIDS blocks the network connection, the firewall prevents the malware execution, and the HIPS alerts on the file change
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How do HIDS, HIPS, and endpoint firewalls complement each other in a layered endpoint security strategy?

   • AThe HIPS replaces the need for an endpoint firewall
   • BThey are redundant and only one is needed for adequate protection
   • CThe HIDS filters traffic, the firewall blocks malicious actions, and the HIPS detects and alerts
   • DThe firewall filters traffic, the HIPS blocks malicious actions, and the HIDS detects and alerts on suspicious activity
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is implementing endpoint firewalls on all employee laptops. The security team wants to ensure that employees can use web browsers and email clients, but the team also wants to block traffic to known malicious domains. Which endpoint firewall feature should the team use to achieve this?

   • AApplication-based rules that allow only web browsers and email clients to run.
   • BOutbound filtering rules that block traffic to specific domain names or IP addresses associated with malicious activity.
   • CSignature-based detection rules that alert on malicious domain lookups.
   • DInbound filtering rules that block traffic from known malicious IP addresses.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   How does application control contribute to host-based intrusion prevention?

   • ABy monitoring network connections for malicious traffic
   • BBy allowing only approved applications to execute on the host
   • CBy updating the operating system with security patches
   • DBy analyzing system logs for suspicious patterns
   Reveal Solution Discussion Select an answer first