200-201 Question 5
Single answerA company is deciding between deploying a host-based intrusion detection system (HIDS) and a network-based intrusion detection system (NIDS). The organization has critical servers that handle sensitive data and wants to focus on detecting potential malicious activities on these servers specifically. Which security deployment is most suitable in this scenario?
- A
Host-based Intrusion Detection System (HIDS)
- B
Network-based Intrusion Detection System (NIDS)
- C
Cloud Access Security Broker (CASB)
- D
Endpoint Detection and Response (EDR)
Show answer and explanation
Correct answer: A
Explanation
A Host-based Intrusion Detection System (HIDS) is the best choice for monitoring and detecting malicious activities on specific servers or hosts, particularly critical systems handling sensitive data. HIDS operates at the host level, making it an appropriate solution for the organization's specific requirement to focus on server-based detection.
- A. Correct.
HIDS is suitable for monitoring and detecting malicious activities on specific hosts or endpoints, such as critical servers. It operates at the host level and is ideal for environments where a detailed focus on individual systems is required.
- B. Incorrect.
NIDS is designed to monitor network traffic and detect threats at the network level. While effective for network-wide visibility, it is not the most focused solution for monitoring activities on individual servers.
- C. Incorrect.
CASB is primarily used to secure cloud services and ensure compliance with organizational policies. It does not address the specific need for detecting threats on individual critical servers.
- D. Incorrect.
EDR provides advanced threat detection and response capabilities for endpoints. However, it is more suited for active response and remediation rather than just intrusion detection, which is the focus of the scenario.