200-201 Question 180
Single answerYou are a cybersecurity analyst tasked with monitoring an organization's endpoints using a Host-based Intrusion Detection System (HIDS). During routine analysis, you observe that one of the endpoints has frequent unauthorized attempts to access critical system files. What is the primary role of a HIDS in this situation?
- A
Detect unauthorized access and alert the analyst
- B
Automatically block unauthorized access to system files
- C
Encrypt the critical system files to prevent tampering
- D
Replace the compromised files with backup copies
Show answer and explanation
Correct answer: A
Explanation
A Host-based Intrusion Detection System (HIDS) is designed to monitor and analyze the activities on a host (such as an endpoint or server) to detect unauthorized access or malicious behavior. In this scenario, the HIDS's role is to identify the unauthorized access attempts and alert the cybersecurity analyst, allowing them to investigate and respond appropriately. HIDS typically does not actively block threats or modify system files.
- A. Correct.
HIDS primarily detects unauthorized access or suspicious activities and alerts the analyst for further action.
- B. Incorrect.
While some systems may include prevention mechanisms, HIDS is primarily designed for detection and alerting, not active blocking.
- C. Incorrect.
Encryption is not a function of a HIDS. HIDS is focused on monitoring and detection, not securing files proactively.
- D. Incorrect.
HIDS does not handle file restoration or replacement. It is used to detect and report suspicious activities.