312-50V11 · Question #740
Tremp is an IT Security Manager, and he is planning to deploy an IDS in his small company. He is looking for an IDS with the following characteristics: -Verifies success or failure of an attack…
The correct answer is C. Host-based IDS. Host-based IDS (HIDS) runs directly on the endpoint, giving it visibility into local system activities without needing dedicated hardware.
Question
Tremp is an IT Security Manager, and he is planning to deploy an IDS in his small company. He is looking for an IDS with the following characteristics: -Verifies success or failure of an attack - Monitors system activities - Detects attacks that a network-based IDS fails to detect. - Near real- time detection and response - Does not require additional hardware - Lower entry cost. Which type of IDS is best suited for Tremp's requirements?
Options
- ANetwork-based IDS
- BOpen source-based IDS
- CHost-based IDS
- DGateway-based IDS
How the community answered
(53 responses)- A6% (3)
- B9% (5)
- C83% (44)
- D2% (1)
Why each option
Host-based IDS (HIDS) runs directly on the endpoint, giving it visibility into local system activities without needing dedicated hardware.
Network-based IDS requires dedicated hardware or a network tap and cannot verify whether an attack succeeded at the host level or detect host-only attacks.
Open source-based IDS is a licensing/cost category, not an IDS deployment type, and does not describe the detection architecture required.
HIDS meets all listed requirements: it monitors system-level activities and logs, detects attacks invisible to network sensors (e.g., local privilege escalation), verifies attack success or failure by inspecting OS state, operates near real-time, requires no additional hardware since it runs on existing hosts, and has a lower entry cost than deploying network appliances.
Gateway-based IDS sits at the network perimeter, requires dedicated gateway hardware, and cannot monitor internal system activities or verify host-level attack success.
Concept tested: Host-based vs network-based IDS characteristics
Source: https://www.cisa.gov/sites/default/files/publications/justifying-ids-final.pdf
Topics
Community Discussion
No community discussion yet for this question.