Which of the following is an intrusion detection system that monitors and analyzes the internals of
a computing system rather than the network packets on its external interfaces?

A.
IPS

B.
HIDS

C.
DMZ

D.
NIDS

Explanation:

A host-based intrusion detection system (HIDS) produces a false alarm because of the abnormal
behavior of users and the network. A host-based intrusion detection system (HIDS) is an intrusion
detection system that monitors and analyses the internals of a computing system rather than the
network packets on its external interfaces. A host-based Intrusion Detection System (HIDS)
monitors all or parts of the dynamic behavior and the state of a computer system. HIDS looks at
the state of a system, its stored information, whether in RAM, in the file system, log files or
elsewhere; and checks that the contents of these appear as expected.
Answer option D is incorrect. A network intrusion detection system (NIDS) is an intrusion detection
system that tries to detect malicious activity such as denial of service attacks, port scans or even
attempts to crack into computers by monitoring network traffic. A NIDS reads all the incoming
packets and tries to find suspicious patterns known as signatures or rules. It also tries to detect
incoming shell codes in the same manner that an ordinary intrusion detection systems does.
Answer option A is incorrect. IPS (Intrusion Prevention Systems), also known as Intrusion
Detection and Prevention Systems (IDPS), are network security appliances that monitor network
and/or system activities for malicious activity. The main functions of “intrusion prevention systems”
are to identify malicious activity, log information about said activity, attempt to block/stop activity,
and report activity. An IPS can take such actions as sending an alarm, dropping the malicious
packets, resetting the connection and/or blocking the traffic from the offending IP address. An IPS
can also correct CRC, unfragment packet streams, prevent TCP sequencing issues, and clean up
unwanted transport and network layer options.
Answer option C is incorrect. DMZ, or demilitarized zone, is a physical or logical subnetwork that
contains and exposes an organization’s external services to a larger untrusted network, usually
the Internet. The term is normally referred to as a DMZ by IT professionals. It is sometimes
referred to as a Perimeter Network. The purpose of a DMZ is to add an additional layer of security
to an organization’s Local Area Network (LAN); an external attacker only has access to equipment
in the DMZ rather than any other part of the network.