nerdexam
GIAC

GSEC · Question #170

Which of the following monitors program activities and modifies malicious activities on a system?

The correct answer is B. HIDS. A Host-based Intrusion Detection System (HIDS) monitors processes and activities on a specific host and can detect or respond to malicious behavior at the system level.

Network Security

Question

Which of the following monitors program activities and modifies malicious activities on a system?

Options

  • ABack door
  • BHIDS
  • CNIDS
  • DRADIUS

How the community answered

(38 responses)
  • A
    13% (5)
  • B
    74% (28)
  • C
    8% (3)
  • D
    5% (2)

Why each option

A Host-based Intrusion Detection System (HIDS) monitors processes and activities on a specific host and can detect or respond to malicious behavior at the system level.

ABack door

A back door is a covert method for bypassing normal authentication to gain unauthorized access - it is an attack vector, not a monitoring or defense tool.

BHIDSCorrect

HIDS (Host-based Intrusion Detection System) resides on an individual endpoint and monitors operating system calls, application logs, file system changes, and running processes to identify and alert on malicious activity. Unlike network-based solutions, it has direct visibility into program-level behavior on the local system.

CNIDS

NIDS (Network-based Intrusion Detection System) monitors network traffic for suspicious patterns but does not inspect program activities or process-level behavior on individual hosts.

DRADIUS

RADIUS is an AAA (Authentication, Authorization, Accounting) protocol used for network access control and has no capability to monitor or respond to malicious program activity.

Concept tested: Host-based intrusion detection system function

Source: https://csrc.nist.gov/publications/detail/sp/800-94/final

Topics

#HIDS#host intrusion detection#malicious activity monitoring

Community Discussion

No community discussion yet for this question.

Full GSEC Practice