Host-Based Intrusion Protection (HIPS) systems are often deployed in monitoring or learning mode
during their initial implementation. What is the objective of starting in this mode?
A.
Automatically create exceptions for specific actions or files
B.
Determine which files are unsafe to access and blacklist them
C.
Automatically whitelist actions or files known to the system
D.
Build a baseline of normal or safe system events for review