Examkin

Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

A security analyst needs to monitor critical database servers for unauthorized local file integrity modifications and zero-day memory exploits that lack known attack signatures. Which security solution best addresses these requirements?

  1. Host-based Intrusion Detection System (HIDS) utilizing anomaly-based detection logicAnswer
  2. B
    Network Intrusion Prevention System (NIPS) relying on signature-based matching deployed inline at the network edge
  3. C
    Network Intrusion Detection System (NIDS) connected via a switch SPAN port filtering standard Layer 4 TCP port numbers
  4. D
    Switch Access Control Lists (ACLs) configured strictly with explicit permit statements for server management IP subnets

Answer

A Host-based Intrusion Detection System (HIDS) utilizing anomaly-based detection logic is the correct solution.
Deploying a Host-based Intrusion Detection System (HIDS) with anomaly-based detection directly monitors local operating system activities, including system call sequences and file integrity changes on the server. Anomaly-based logic compares real-time host activity against an established baseline of normal operations, allowing it to detect unknown zero-day attacks that do not match existing signatures.

Step-by-Step Solution

1
Identify the scope of monitoring required by the scenario.
The requirement specifies host-level monitoring, including local file modifications and process execution, which requires endpoint visibility rather than network link visibility.
Network-based systems (NIDS/NIPS) analyze packet streams across network interfaces and cannot monitor internal host OS processes or local file integrity.
2
Determine the appropriate detection mechanism for zero-day threats.
Anomaly-based (behavioral) detection establishes a baseline of normal system activity and flags deviations, making it effective against unknown threats.
Signature-based detection requires pre-existing pattern definitions, which are unavailable for novel zero-day attacks.
3
Synthesize placement and mechanism to select the correct technology.
Combining host-level placement (HIDS) with behavioral detection (anomaly-based) satisfies both monitoring requirements.
HIDS operates on the host OS to observe file modifications and kernel calls while anomaly detection identifies novel exploits.

Key Concept

HIDS vs NIDS/NIPS placement and Anomaly-based vs Signature-based detection mechanisms
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic