Matt, an IT administrator, wants to protect a newly built server from zero day attacks. Which of the following
would provide the BEST level of protection?

A.
HIPS

B.
Antivirus

C.
NIDS

D.
ACL

Explanation:
Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are
network security appliances that monitor network and/or system activities for malicious activity. The main
functions of intrusion prevention systems are to identify malicious activity, log information about this activity,
attempt to block/stop it, and report it.
Intrusion prevention systems are considered extensions of intrusion detection systems because they both
monitor network traffic and/or system activities for malicious activity. The main differences are, unlike intrusion
detection systems, intrusion prevention systems are placed in-line and are able to actively prevent/block
intrusions that are detected. More specifically, IPS can take such actions as sending an alarm, dropping the
malicious packets, resetting the connection and/or blocking the traffic from the offending IP address. An IPS
can also correct Cyclic Redundancy Check (CRC) errors, unfragment packet streams, prevent TCP sequencing
issues, and clean up unwanted transport and network layer options.
Host-based intrusion prevention system (HIPS) is an installed software package which monitors a single host
for suspicious activity by analyzing events occurring within that host.
A Host-based intrusion prevention system (HIPS) is an installed software package which monitors a single host
for suspicious activity by analyzing events occurring within that host. As a zero-day attack is an unknown
vulnerability (a vulnerability that does not have a fix or a patch to prevent it), the best defence would be an
intrusion prevention system.