What is the difference between a network-based intrusion detection system (NIDS) and a host-based intrusion detection system (HIDS)?1 分A NIDS logs and generates alerts. A HIDS system monitors endpoint activity.Both NIDS and HIDS monitor systems and generate alerts, but a NIDS use agents.A NIDS collects and monitors network traffic and network data. A HIDS monitors the activity of the host on which it is installed.A NIDS monitors the activity of the host on which it is installed. A HIDS uses signature analysis to analyze network activity.

What is the difference between an HIDS and a firewall?Select one:A firewall performs packet filtering and therefore is limited in effectiveness, whereas an HIDS blocks intrusions.An HIDS works like an IPS, whereas a firewall just monitors traffic.An HIDS monitors operating systems on host computers and processes file system activity. Firewalls allow or deny traffic between the computer and other systems.A firewall allows and denies traffic based on rules and an HIDS monitors network traffic.An HIDS blocks intrusions, whereas a firewall filters them.

What is the difference between signature based and anomaly-based intrusion detection system (IDS) technologies?a.Signature-based IDS blocks traffic without an appropriate digital signature, while anomaly-based IDS only alerts on traffic that is not originalb.Signature-based IDS blocks attackers that match a malware signature list, while anomaly-based IDS establish a baseline and then look for variations from the baselinec.Signature-based IDS compares the signature in a packet to determine if the signature is authentic, while an anomaly-based IDS looks for odd occurrences on a systemd.Signature-based IDS flags nefarious traffic with a digital signature, while anomaly-based IDS reviews traffic time stamps and alerts on those that do not match the system time

4.Question 4What actions does an intrusion prevention system (IPS) perform? Select three answers.1 pointMonitor activityManage security incidentsDetect abnormal activityStop intrusive activity

Which type of device deployment is typically positioned inline with network traffic, allowing it to actively block malicious traffic?Network-based IPS (NIPS)Host-based IDS (HIDS)Network-based IDS (NIDS)Host-based IPS (HIPS)

Select the intrusion detection/prevention system in each scenario.A software application that analyzes a host's running processes to detect a threat against the host.A software application that runs on a host and protects the host from a network attack.A device or software application that can disconnect a suspicious network connection.A device or software application that monitors and analyzes network activity.