GSEC · Question #170
Which of the following monitors program activities and modifies malicious activities on a system?
The correct answer is B. HIDS. A Host-based Intrusion Detection System (HIDS) monitors processes and activities on a specific host and can detect or respond to malicious behavior at the system level.
Question
Which of the following monitors program activities and modifies malicious activities on a system?
Options
- ABack door
- BHIDS
- CNIDS
- DRADIUS
How the community answered
(38 responses)- A13% (5)
- B74% (28)
- C8% (3)
- D5% (2)
Why each option
A Host-based Intrusion Detection System (HIDS) monitors processes and activities on a specific host and can detect or respond to malicious behavior at the system level.
A back door is a covert method for bypassing normal authentication to gain unauthorized access - it is an attack vector, not a monitoring or defense tool.
HIDS (Host-based Intrusion Detection System) resides on an individual endpoint and monitors operating system calls, application logs, file system changes, and running processes to identify and alert on malicious activity. Unlike network-based solutions, it has direct visibility into program-level behavior on the local system.
NIDS (Network-based Intrusion Detection System) monitors network traffic for suspicious patterns but does not inspect program activities or process-level behavior on individual hosts.
RADIUS is an AAA (Authentication, Authorization, Accounting) protocol used for network access control and has no capability to monitor or respond to malicious program activity.
Concept tested: Host-based intrusion detection system function
Source: https://csrc.nist.gov/publications/detail/sp/800-94/final
Topics
Community Discussion
No community discussion yet for this question.