Which three statements about host-based IPS are true? (Choose three)

Because HIPS operates on the host itself, it can inspect files and processes after decryption occurs in memory, giving it visibility that network-based IPS lacks when traffic is encrypted.

HIPS is installed on individual endpoints to protect those specific hosts; perimeter deployment is the role of network-based IPS or firewalls.

While HIPS can use signatures, it is primarily distinguished by behavioral and anomaly-based detection; signature-based policies alone are more characteristic of network-based IPS, and this is not one of the three defining true statements.

HIPS policies are applied per host, allowing administrators to enforce stricter rules tailored to a specific system's role or risk profile compared to the broader policies of a network IPS.

HIPS operates independently on the host and does not require or depend on deployed firewalls to function; its protection is self-contained at the endpoint.

HIPS monitors OS calls, application behavior, and user activity directly on the endpoint, enabling it to generate alerts based on suspicious behavior observed at the desktop level.