Which of the following statements about a host-based intrusion prevention system (HIPS) are true? Each correct answer represents a complete solution. Choose two.

Because HIPS operates directly on the host after the OS handles decryption, it can inspect both encrypted and unencrypted traffic equally - unlike network-based IPS, which cannot read encrypted payloads in transit without out-of-band decryption capabilities.

Detecting events scattered over the network is a capability of network-based IDS/IPS (NIDS/NIPS), not HIPS, which is scoped to the individual host on which it is installed.

Allowing multiple computers to share one or more IP addresses describes Network Address Translation (NAT), which is a network routing concept entirely unrelated to intrusion prevention systems.

HIPS is installed on a single endpoint and monitors only events occurring on that specific host, so it cannot detect or correlate attack activity distributed across multiple systems on the network.