Which of the following is NOT a benefit of using HID?

The correct answer is D. Provides automatic removal of detected threats. D is correct because HIDS (Host Intrusion Detection System) is designed purely to detect and alert - automatic threat removal is the job of tools like antivirus/anti-malware or an IPS (Intrusion Prevention System), not a detection system. Why the distractors are wrong (i.e…

Threat Detection and Incident Response

Question

Options

AProvides real-time detection of security incidents
BAllows for quick response to security incidents
CHelps prevent security incidents from occurring
DProvides automatic removal of detected threats

How the community answered

(32 responses)

A
6% (2)
B
3% (1)
D
91% (29)

Explanation

D is correct because HIDS (Host Intrusion Detection System) is designed purely to detect and alert - automatic threat removal is the job of tools like antivirus/anti-malware or an IPS (Intrusion Prevention System), not a detection system.

Why the distractors are wrong (i.e., they ARE real benefits):

A - HIDS continuously monitors host activity and generates alerts as suspicious events happen, enabling real-time detection.
B - By surfacing alerts quickly, HIDS gives security teams the information needed to respond fast and contain incidents.
C - Early detection of anomalous behavior can stop an attack from escalating, contributing to incident prevention.

Memory tip: Focus on the word Detection in HIDS - a detector finds and signals a fire; it doesn't put it out. Anything involving automatic action (blocking, removing, quarantining) belongs to prevention/response tools, not detection systems. On the exam, if an answer describes HIDS doing something active and automated, that's your red flag.

Topics

#Host Intrusion Detection#Incident Detection#Threat Response#Detection vs Prevention

Community Discussion

No community discussion yet for this question.

Full 303-300 Practice