HIDS/HIPS/Endpoint Firewalls GMON Practice Questions (Page 8)

Questions 36–37

1. 36application · medium

   A SOC analyst is reviewing HIDS alerts from a Linux server. The HIDS has generated a high volume of alerts for failed SSH login attempts from a single IP address. The analyst wants to reduce the noise while still being alerted to successful brute-force attacks. What is the most appropriate action?

   • ACreate a suppression rule that groups multiple failed login attempts from the same source into a single alert.
   • BIncrease the alert threshold to require 100 failed attempts before generating an alert.
   • CDisable the SSH login alert rule entirely.
   • DConfigure the HIDS to only alert on successful SSH logins.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security architect is designing endpoint protection for a high-security environment. The environment includes servers that process classified data and must be protected against both known and unknown threats. The architect has budget for only one additional control beyond the existing HIDS deployment. The primary threat model includes zero-day exploits and insider threats. Which control provides the most comprehensive protection against this threat model?

   • AAn endpoint firewall with strict inbound and outbound rules.
   • BA HIPS with behavioral analysis and application control.
   • CA HIPS with signature-based detection and application control.
   • DAn enhanced HIDS with more comprehensive file integrity monitoring and logging.
   Reveal Solution Discussion Select an answer first