Examkin

Question

Difficulty: HardIntrusion Detection and Prevention Systems (IDS/IPS)

A network engineer observes anomalous latency spikes on a critical web application server following a recent security upgrade. Upon investigation, the engineer discovers that security software deployed directly on the web server is performing deep packet inspection on all local system calls and application memory buffers, creating processing overhead under high traffic load. Which security control is actively causing this host-level performance degradation?

  1. Host-based Intrusion Prevention System (HIPS)Answer
  2. B
    Network-based Intrusion Detection System (NIDS)
  3. C
    Stateful Network Firewall operating at Layer 4
  4. D
    Network-based Intrusion Prevention System (NIPS)

Answer

Host-based Intrusion Prevention System (HIPS)
The scenario describes a security agent installed directly on the host machine inspecting operating system calls and memory buffers in real time. A Host-based Intrusion Prevention System (HIPS) provides active protection at the host level, which can introduce noticeable CPU and latency overhead on high-traffic servers due to deep host-level inspection.

Step-by-Step Solution

1
Analyze the location of execution and inspection targets described in the scenario.
The control is executing directly on the web server host and inspecting host-level resources (system calls and memory buffers).
Host-based controls run as agents on individual endpoints rather than monitoring network interfaces.
2
Differentiate between detection (passive) and prevention (active inline/intervening) mechanisms.
Because the control actively inspects and acts upon host system calls during execution, it operates as an active inline host control.
Intrusion Prevention Systems (IPS) intercept and analyze actions before permitting execution, adding local host CPU/memory processing overhead.
3
Synthesize the architecture and deployment type to select the correct system.
A Host-based Intrusion Prevention System (HIPS) matches both host-level deployment and active inspection characteristics.
HIPS provides real-time protection at the OS/application layer on host devices.

Key Concept

Host-based Intrusion Prevention System (HIPS) operation and host resource impact
Estimated Time:2m 0s
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic