nerdexam
(ISC)2

CSSLP · Question #345

Which of the following statements about a host-based intrusion prevention system (HIPS) are true? Each correct answer represents a complete solution. Choose two.

The correct answer is C. It can handle encrypted and unencrypted traffic equally. D. It cannot detect events scattered over the network. A Host-based Intrusion Prevention System (HIPS) operates on a single host, allowing it to inspect both encrypted and unencrypted traffic, but limiting its visibility to events only on that specific host, preventing detection of network-wide activities.

Secure Software Deployment, Operations, Maintenance

Question

Which of the following statements about a host-based intrusion prevention system (HIPS) are true? Each correct answer represents a complete solution. Choose two.

Options

  • AIt can detect events scattered over the network.
  • BIt is a technique that allows multiple computers to share one or more IP addresses.
  • CIt can handle encrypted and unencrypted traffic equally.
  • DIt cannot detect events scattered over the network.

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    4% (1)
  • C
    92% (24)

Why each option

A Host-based Intrusion Prevention System (HIPS) operates on a single host, allowing it to inspect both encrypted and unencrypted traffic, but limiting its visibility to events only on that specific host, preventing detection of network-wide activities.

AIt can detect events scattered over the network.

HIPS cannot detect events scattered over the network because its scope is limited to the host where it is installed; network-wide event detection is a function of Network-based IPS (NIPS).

BIt is a technique that allows multiple computers to share one or more IP addresses.

The statement "It is a technique that allows multiple computers to share one or more IP addresses" describes Network Address Translation (NAT), not a Host-based Intrusion Prevention System.

CIt can handle encrypted and unencrypted traffic equally.Correct

A HIPS operates at the endpoint, meaning it can inspect traffic after it has been decrypted by the host's operating system, allowing it to analyze both encrypted and unencrypted traffic effectively.

DIt cannot detect events scattered over the network.Correct

Since a HIPS is installed and runs on an individual host, it can only monitor and detect events occurring on that specific host, not events or traffic scattered across the broader network.

Concept tested: Host-based Intrusion Prevention System (HIPS) Capabilities

Topics

#HIPS#Intrusion Prevention#Host Security#Security Controls

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CSSLP Practice