What is host intrusion detection (HID)?

Question

Options

• AA system that detects malicious traffic on a network
• BA system that monitors and detects potential security threats on a single computer or server
• CA system that prevents malware from infecting a network
• DA system that scans files and folders for viruses

• A
  1% (1)
• B
  94% (63)
• C
  3% (2)
• D
  1% (1)

Explanation

B is correct because Host Intrusion Detection (HID) operates at the individual host level - a single computer or server - monitoring system activity, logs, file integrity, and processes to detect suspicious behavior or policy violations.

• A is wrong because monitoring network traffic is the job of a Network Intrusion Detection System (NIDS), not a host-based one.
• C is wrong because prevention (blocking threats) describes an Intrusion Prevention System (IPS) or firewall - detection systems observe and alert, they don't actively stop.
• D is wrong because scanning files for viruses describes antivirus software, which is a narrower, reactive tool compared to the broader behavioral monitoring HIDS performs.

Memory tip: Think "HID = Host Is Detective" - it watches what's happening on the machine itself and reports suspicious activity, like a detective taking notes rather than a guard blocking the door.

No community discussion yet for this question.