200-201 Question 6
Select 3An organization is deciding between deploying a host-based intrusion detection system (HIDS) and a network-based intrusion detection system (NIDS). Which of the following are key differences between these two types of security deployments?
- A
HIDS monitors activity on individual devices, while NIDS monitors traffic across the entire network.
- B
NIDS is more effective at detecting insider threats than HIDS.
- C
HIDS can detect unauthorized changes to files and processes on a host, while NIDS cannot.
- D
NIDS requires endpoint agents to be installed on each device, while HIDS requires only a central monitoring device.
- E
HIDS typically has access to encrypted data on the host, while NIDS cannot analyze encrypted network traffic in transit.
Show answer and explanation
Correct answers: A, C, E
Explanation
HIDS and NIDS serve different purposes in security deployments. HIDS focuses on monitoring and detecting threats on individual devices, such as unauthorized file changes and process anomalies. NIDS, on the other hand, monitors network traffic to identify malicious activities across the network. HIDS may have visibility into encrypted data on the host, while NIDS cannot analyze encrypted traffic in transit. Understanding these distinctions is critical for selecting the appropriate security deployment for a given use case.
- A. Correct.
HIDS is designed to monitor activity on individual devices, such as file changes, process anomalies, and log entries. NIDS focuses on monitoring network traffic for signs of malicious activity across the entire network.
- B. Incorrect.
NIDS is not inherently more effective at detecting insider threats. Insider threats are often better identified using HIDS, as it can monitor local user activity and system changes.
- C. Correct.
HIDS is capable of detecting unauthorized changes to files and processes on the host, which is outside the scope of what NIDS is designed to monitor.
- D. Incorrect.
NIDS does not require endpoint agents; it typically operates using a central network tap or port mirroring to analyze traffic. HIDS, however, requires installation on each host it protects.
- E. Correct.
HIDS can access encrypted data on the host since it operates at the endpoint level and has visibility into decrypted data. NIDS struggles with encrypted traffic since it only observes data in transit.