Examkin

Question

Difficulty: MediumIntrusion Detection and Prevention Systems (IDS/IPS)

An organization is enhancing its security monitoring architecture to detect zero-day exploits and analyze encrypted network application traffic. The network engineering team decides to deploy Host-based Intrusion Detection Systems (HIDS) across critical endpoints. Which of the following capabilities represent distinct operational advantages of a HIDS compared to a passive Network Intrusion Detection System (NIDS)? (Select TWO.)

  1. HIDS can inspect decrypted application payload data directly within local endpoint memory after TLS protocol termination.Answer
  2. HIDS can monitor host operating system calls, registry modifications, and critical file system integrity changes.Answer
  3. C
    HIDS captures network traffic out-of-band using switch SPAN ports to ensure zero added latency to endpoint CPU processing.
  4. D
    HIDS automatically appends an implicit deny statement to perimeter network Access Control Lists whenever unauthorized access is detected.

Answer

The correct options are that a HIDS can inspect decrypted application payload data directly within local endpoint memory after TLS protocol termination, and a HIDS can monitor host operating system calls, registry modifications, and critical file system integrity changes.
Host-based Intrusion Detection Systems (HIDS) run as agents on individual host operating systems. This positioning grants direct visibility into unencrypted host memory, local system calls, process creation, registry key modifications, and file integrity. Consequently, HIDS can evaluate application data after local SSL/TLS decryption and track malicious actions inside the OS.

Step-by-Step Solution

1
Analyze the operational scope of Host-based Intrusion Detection Systems (HIDS).
HIDS software resides on individual hosts, providing visibility into local system calls, memory state, local storage, and process execution.
Host-level agent placement allows access to internal OS subsystems and post-decryption data buffers.
2
Compare host-level monitoring capabilities against network-level passive monitoring (NIDS).
NIDS monitors network traffic passing through network segments or SPAN/TAP ports and cannot inspect encrypted payloads without external SSL/TLS offloading, nor can it monitor local host registry changes.
NIDS is restricted to network packet headers and payloads captured in transit.
3
Select the statements describing unique HIDS operational advantages.
Inspecting decrypted payload memory and auditing host OS system calls/registry modifications are host-specific features.
These capabilities require direct kernel and local filesystem visibility present only on the endpoint.

Key Concept

Host-Based vs. Network-Based Intrusion Detection Systems (HIDS vs NIDS)
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic