Joe, a network security engineer, has visibility to network traffic through network monitoring tools. However, he's concerned that a disgruntled employee may be targeting a server containing the…

A HIDS agent runs on the target server and monitors local activity such as file access, system calls, and log events, allowing Joe to confirm whether the disgruntled employee is accessing or tampering with the financial records server. Unlike network-based tools, HIDS operates at the host level and can detect insider threats that do not generate anomalous network traffic. This makes it the most precise tool for confirming suspicious activity on a specific machine.

A HIPS actively blocks suspicious activity on the host rather than passively logging and alerting, which is less appropriate when the goal is to confirm and gather evidence of suspicious behavior.

A NIPS (Network Intrusion Prevention System) monitors and blocks malicious network traffic and would not capture local server-side access by an internal user on the same host.

A NIDS (Network Intrusion Detection System) monitors network traffic between hosts and would not detect a user interacting directly with files on the server from the console or through an already-established session.