210-250 · Question #46
Where is a host-based intrusion detection system located?
The correct answer is A. on a particular end-point as an agent or a desktop application. A host-based intrusion detection system (HIDS) runs directly on the endpoint it protects, monitoring system calls, logs, and file integrity from within the host itself.
Question
Where is a host-based intrusion detection system located?
Options
- Aon a particular end-point as an agent or a desktop application
- Bon a dedicated proxy server monitoring egress traffic
- Con a span switch port
- Don a tap switch port
How the community answered
(46 responses)- A91% (42)
- B2% (1)
- C4% (2)
- D2% (1)
Why each option
A host-based intrusion detection system (HIDS) runs directly on the endpoint it protects, monitoring system calls, logs, and file integrity from within the host itself.
A HIDS is deployed as a software agent or application installed directly on an individual endpoint such as a workstation or server. It monitors internal activity like file changes, process execution, and system calls rather than network traffic, making the endpoint itself the detection vantage point.
A dedicated proxy server monitoring egress traffic is a network-level control, not a host-based one.
A SPAN port mirrors network traffic to a network-based IDS (NIDS), not a host-based system.
A TAP port is also a passive network monitoring technique used by NIDS, not HIDS.
Concept tested: Host-based vs. network-based IDS placement
Source: https://csrc.nist.gov/publications/detail/sp/800-94/final
Topics
Community Discussion
No community discussion yet for this question.