Which of the following systems monitors the operating system detecting inappropriate activity, writing to log files, and triggering alarms?

Question

Options

• AHost-based ID system
• BBehavior-based ID system
• CNetwork-based ID system
• DSignature-Based ID system

• A
  79% (15)
• C
  16% (3)
• D
  5% (1)

Explanation

A Host-based Intrusion Detection System (HIDS) runs directly on an individual host and monitors that machine's operating system activity - watching system calls, log files, file integrity, and user behavior - then writes to logs and triggers alerts when suspicious activity is detected. This makes it the only option that specifically "monitors the operating system" on a per-machine basis.

Why the others are wrong:

• B (Behavior-based IDS) describes a detection method (baselining normal behavior and alerting on deviations), not a system placement - it can be either host- or network-based.
• C (Network-based IDS) monitors network traffic packets rather than the OS itself; it sits on the network, not the host.
• D (Signature-based IDS) is also a detection method, matching traffic or activity against known attack patterns - again, not a placement type.

Memory tip: Think Host = Hard drive/OS - HIDS lives on the machine watching the OS internals, while Network-based IDS watches the wire. The "behavior" and "signature" options are how detection works, not where - a common trick to confuse placement vs. method.

No community discussion yet for this question.