You get an alert on your desktop computer showing that an attack was successful on the host but up on investigation you see that occurred duration the attack. Which reason is true?

HIDS is installed directly on a host and monitors system calls, file changes, and logs to detect suspicious activity. Because HIDS is detection-only, it will trigger an alert when an attack occurs but will not actively stop it, which explains why the alert fires yet the attack still proceeds. Investigation after the alert reveals detailed logs of what occurred during the attack, which is characteristic HIDS behavior.

NIDS monitors network traffic at the network level rather than on an individual host, so it would not generate an alert directly on a desktop computer.

HIPS actively blocks detected attacks in real time on the host, meaning the attack would have been prevented and would not register as successful.

NIPS monitors and blocks attacks at the network perimeter level, not on individual host systems, so it would not produce a host-level alert in this scenario.