Which of the following is a best practice for implementing HID?

Question

Options

• AInstall HID on every computer in the network
• BConfigure HID to block all incoming traffic
• CConfigure HID to alert security personnel of potential security incidents
• DDisable HID when not actively monitoring for security incidents

• A
  3% (1)
• B
  3% (1)
• C
  94% (29)

Explanation

Configuring HID (Host Intrusion Detection) to alert security personnel (C) aligns with its core purpose: detection and notification, not prevention - HIDS monitors system activity for suspicious behavior and notifies analysts so they can respond appropriately.

• A is wrong - installing HID on every machine is often impractical and unnecessary; deployment should be risk-based, targeting critical or sensitive hosts.
• B is wrong - blocking all incoming traffic describes a firewall or IPS (Intrusion Prevention System), not an IDS; detection systems observe and report, they don't block by default.
• D is wrong - disabling HID when not actively watching defeats the purpose entirely; threats don't pause when no one is looking, so continuous monitoring is essential.

Memory tip: Remember the "D" in IDS stands for Detection, not Defense - its job is to alert, not act. If a question mentions blocking or preventing, think IPS (Prevention System) instead.

No community discussion yet for this question.