SSCP · Question #947
Which of the following reviews system and event logs to detect attacks on the host and determine if the attack was successful?
The correct answer is A. host-based IDS. A host-based IDS (HIDS) monitors and analyzes the logs generated by the operating system and applications on the host - including security event logs, system logs, and audit trails. By reviewing these log records, a HIDS can identify indicators of attack (e.g., repeated failed…
Question
Which of the following reviews system and event logs to detect attacks on the host and determine if the attack was successful?
Options
- Ahost-based IDS
- Bfirewall-based IDS
- Cbastion-based IDS
- Dserver-based IDS
How the community answered
(35 responses)- A86% (30)
- B3% (1)
- C9% (3)
- D3% (1)
Explanation
A host-based IDS (HIDS) monitors and analyzes the logs generated by the operating system and applications on the host - including security event logs, system logs, and audit trails. By reviewing these log records, a HIDS can identify indicators of attack (e.g., repeated failed logins, privilege escalation events, unexpected file modifications) and also determine whether an attack succeeded by correlating log entries over time. This log-analysis capability is a defining characteristic of HIDS and distinguishes it from a network-based IDS, which focuses on packet traffic rather than host-level activity.
Topics
Community Discussion
No community discussion yet for this question.