nerdexam
GIAC

GSEC · Question #12

Which of the following is an advantage of a Host Intrusion Detection System (HIDS) versus a Network Intrusion Detection System (NIDS)?

The correct answer is A. Ability to detect malicious traffic after it has been decrypted by the host. A HIDS inspects activity at the host level, meaning it can analyze traffic or data after the host's TLS/SSL stack has already decrypted it, giving it visibility into the plaintext payload that a NIDS cannot see.

Penetration Testing Foundations & Reconnaissance

Question

Which of the following is an advantage of a Host Intrusion Detection System (HIDS) versus a Network Intrusion Detection System (NIDS)?

Options

  • AAbility to detect malicious traffic after it has been decrypted by the host
  • BAbility to decrypt network traffic
  • CAbility to listen to network traffic at the perimeter
  • DAbility to detect malicious traffic before it has been decrypted

How the community answered

(44 responses)
  • A
    73% (32)
  • B
    9% (4)
  • C
    5% (2)
  • D
    14% (6)

Why each option

A HIDS inspects activity at the host level, meaning it can analyze traffic or data after the host's TLS/SSL stack has already decrypted it, giving it visibility into the plaintext payload that a NIDS cannot see.

AAbility to detect malicious traffic after it has been decrypted by the hostCorrect

Because a HIDS operates directly on the endpoint, it analyzes data after the host's operating system or application has performed decryption, allowing it to inspect the actual plaintext content of encrypted sessions such as HTTPS. A NIDS positioned on the network wire only sees the encrypted ciphertext and cannot inspect the payload without inline decryption capabilities. This makes HIDS uniquely effective for detecting threats delivered over encrypted channels.

BAbility to decrypt network traffic

A HIDS does not perform decryption itself - it benefits from seeing already-decrypted data that the host's own SSL/TLS stack processed, which is a distinct capability.

CAbility to listen to network traffic at the perimeter

Monitoring network traffic at the perimeter is a defining characteristic of a NIDS, not a HIDS, which is scoped to a single host.

DAbility to detect malicious traffic before it has been decrypted

Seeing traffic before decryption is a NIDS characteristic since it monitors the wire where ciphertext travels, which is actually a limitation compared to HIDS visibility.

Concept tested: HIDS advantage over NIDS for encrypted traffic inspection

Source: https://csrc.nist.gov/glossary/term/host_based_intrusion_detection_system

Topics

#HIDS#NIDS#intrusion detection#encrypted traffic

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSEC Practice