303-300 · Question #74
What type of activity does HID monitor for?
The correct answer is B. Unauthorized access attempts. HID (Host-based Intrusion Detection) monitors for unauthorized access attempts (B) because its core purpose is detecting suspicious behavior targeting a specific host - such as failed logins, privilege escalation attempts, or policy violations - and alerting administrators…
Question
What type of activity does HID monitor for?
Options
- AMalware infections
- BUnauthorized access attempts
- CNetwork traffic
- DFile and folder changes
How the community answered
(26 responses)- B92% (24)
- C4% (1)
- D4% (1)
Explanation
HID (Host-based Intrusion Detection) monitors for unauthorized access attempts (B) because its core purpose is detecting suspicious behavior targeting a specific host - such as failed logins, privilege escalation attempts, or policy violations - and alerting administrators before a breach occurs.
Why the others are wrong:
- A (Malware infections): That's the domain of antivirus/anti-malware tools, not intrusion detection.
- C (Network traffic): Network traffic monitoring belongs to NID (Network-based Intrusion Detection), not HID. HID operates at the host level, not the network perimeter.
- D (File and folder changes): File integrity monitoring (FIM) tools like Tripwire handle this - though some HID systems include FIM as a feature, it's not HID's primary focus.
Memory tip: Think of HID = Host Intrusion Detection = "Who's trying to get in?" - it watches who is attempting access on a specific machine. If you see "network," think NID; if you see "host," think unauthorized access attempts.
Topics
Community Discussion
No community discussion yet for this question.