Matt, an IT administrator, wants to protect a newly built server from zero day attacks. Which of the
following would provide the BEST level of protection?

A.
HIPS

B.
Antivirus

C.
NIDS

D.
ACL

Explanation:
Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems
(IDPS), are network security appliances that monitor network and/or system activities for malicious
activity. The main functions of intrusion prevention systems are to identify malicious activity, log
information about this activity, attempt to block/stop it, and report it.
Intrusion prevention systems are considered extensions of intrusion detection systems because
they both monitor network traffic and/or system activities for malicious activity. The main
differences are, unlike intrusion detection systems, intrusion prevention systems are placed in-line
and are able to actively prevent/block intrusions that are detected. More specifically, IPS can take
such actions as sending an alarm, dropping the malicious packets, resetting the connection and/or
blocking the traffic from the offending IP address. An IPS can also correct Cyclic Redundancy
Check (CRC) errors, unfragment packet streams, prevent TCP sequencing issues, and clean up
unwanted transport and network layer options.
Host-based intrusion prevention system (HIPS) is an installed software package which monitors a
single host for suspicious activity by analyzing events occurring within that host.
A Host-based intrusion prevention system (HIPS) is an installed software package which monitors
a single host for suspicious activity by analyzing events occurring within that host. As a zero-day
attack is an unknown vulnerability (a vulnerability that does not have a fix or a patch to prevent it),
the best defence would be an intrusion prevention system.