Examkin

Question

Difficulty: HardIntrusion Detection and Prevention Systems (IDS/IPS)

Following a workstation compromise, an enterprise security team observes that an internal database server receives encrypted command-and-control traffic, accompanied by unauthorized local process injection and file integrity alterations. The existing network-based IDS connected via a switch SPAN port failed to decrypt the payload and was structurally incapable of stopping the local system modifications due to its passive out-of-band placement. To actively block unauthorized system calls, memory manipulation, and malicious file modifications directly on the server host, which security technology should be deployed?

  1. Host-based Intrusion Prevention System (HIPS)Answer
  2. B
    Network-based Intrusion Prevention System (NIPS)
  3. C
    Passive Network-based Intrusion Detection System (NIDS) with TAP mirroring
  4. D
    Stateless Access Control List (ACL) on the default gateway switch

Answer

Host-based Intrusion Prevention System (HIPS) should be deployed because it runs locally on the host to monitor and actively block unauthorized system calls, file modifications, and process injections.
A Host-based Intrusion Prevention System (HIPS) is installed directly on host endpoints (such as servers). Because it runs within the operating system, it has complete visibility into decrypted data, file system alterations, registry modifications, and kernel/system calls. Furthermore, as a prevention system, it actively interrupts and blocks unauthorized or anomalous process execution and system calls before damage occurs.

Step-by-Step Solution

1
Analyze the threat vectors and monitoring requirements described in the scenario.
The scenario requires protection against host-level threats (process injection, local system calls, memory modification) and encrypted traffic that out-of-band network sensors cannot inspect or block.
Identifying whether the vulnerability/attack surface is network-centric or endpoint-centric dictates the correct system architecture.
2
Evaluate network-based vs host-based security mechanisms.
Network-based systems (NIDS/NIPS) process network traffic in transit. Host-based systems (HIDS/HIPS) process host activity after network decryption, inspecting internal operating system calls and file systems.
Host-level processes and payload contents encrypted in transit are visible only at the host endpoint.
3
Differentiate between passive detection and active prevention capabilities.
Intrusion Detection Systems (IDS) detect and alert passively, whereas Intrusion Prevention Systems (IPS) sit inline relative to the activity and actively block malicious actions.
The requirement specifically demands actively blocking local system modifications, necessitating an inline prevention technology.

Key Concept

Host-based Intrusion Prevention System (HIPS) vs. Network-based Security Placement
Estimated Time:2m 0s
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic