Which of the following is NOT something that an HIDS will monitor?

Question

Options

• AConfigurations
• BUser logins
• CCritical system files
• DNetwork traffic

• A
  4% (2)
• B
  87% (46)
• C
  8% (4)
• D
  2% (1)

Explanation

Important note: The marked correct answer (B) appears to be incorrect based on standard HIDS definitions.

Network traffic (D) is what an HIDS does NOT monitor - that is the function of a Network-based Intrusion Detection System (NIDS). An HIDS sits on a specific host and has no visibility into broader network traffic flowing between other systems.

Why the distractors are wrong:

• A (Configurations): HIDS actively monitors system and application configuration files for unauthorized changes.
• B (User logins): HIDS absolutely does monitor user login events by analyzing OS audit logs and authentication logs - this is a core HIDS capability.
• C (Critical system files): File integrity monitoring is one of HIDS's primary functions; it hashes and watches key system files for tampering.

Memory tip: Split the acronym - HIDS = Host. Everything it monitors is on that host (files, configs, logins, processes). Anything requiring visibility between hosts or across the wire belongs to NIDS = Network. When you see "network traffic" as an option for what HIDS monitors, that's your answer.

If this question appeared on a practice exam with B as the key, it contains an error. On a real exam (CompTIA Security+, etc.), D is the defensible answer.

No community discussion yet for this question.