ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 243 - SY0-601 discussion

Report
Export

A security engineer is concerned the strategy for detection on endpoints is too heavily dependent on previously defined attacks. The engineer wants a tool that can monitor for changes to key files and network traffic for the device. Which of the following tools should the engineer select?

A.
HIDS
Answers
A.
HIDS
B.
AV
Answers
B.
AV
C.
NGF-W
Answers
C.
NGF-W
D.
DLP
Answers
D.
DLP
Suggested answer: A

Explanation:

The security engineer should select a Host Intrusion Detection System (HIDS) to address the concern. HIDS monitors and analyzes the internals of a computing system, such as key files and network traffic, for any suspicious activity. Unlike antivirus software (AV), which relies on known signatures of malware, HIDS can detect anomalies, policy violations, and previously undefined attacks by monitoring system behavior and the network traffic of the device.

Reference:

1. CompTIA Security+ Certification Exam Objectives (SY0-601):

https://www.comptia.jp/pdf/Security%2B%20SY0-601%20Exam%20Objectives.pdf

2. Scarfone, K., & Mell, P. (2007). Guide to Intrusion Detection and Prevention Systems (IDPS):

Recommendations of the National Institute of Standards and Technology. NIST Special Publication 800-94. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-94.pdf

asked 02/10/2024
Tshimangadzo Mbulawa
35 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first