Host based intrusion devices traditionally analyze log files for:

Question

Options

• AAnomalies in the application operations that may suggest a compromise or a repetitive attack.
• BNetwork traffic
• CDistributed Denial of Service Attacks
• DSystem hardware or software errors

• A
  82% (45)
• B
  11% (6)
• C
  2% (1)
• D
  5% (3)

Explanation

Host-based intrusion detection systems (HIDS) work by monitoring and analyzing log files generated on a specific host - looking for anomalies in application behavior, unusual login patterns, file changes, or repeated failed access attempts that could indicate a breach or ongoing attack, making A correct. Option B is wrong because analyzing network traffic is the domain of network-based intrusion detection systems (NIDS), not host-based ones. Option C (DDoS detection) requires monitoring traffic volume across the network, again a network-level concern outside the scope of a single host's logs. Option D is incorrect because hardware/software error monitoring is the job of system monitoring tools and event management systems, not intrusion detection.

Memory tip: Think "HIDS = Host logs, NIDS = Network traffic" - the word host tells you it's scoped to what happens on that machine, which means application logs and local activity, not the network outside it.

No community discussion yet for this question.