Which of the following monitors program activities and modifies malicious activities on a system?
A.
RADIUS
B.
NIDS
C.
HIDS
D.
Back door
Explanation:
Host-based IDS (HIDS) is an Intrusion Detection System that runs on the system to be monitored. HIDS monitors only the data that is directed to or originating from that particular system on which HIDS is installed. Besides network traffic for detecting attacks, it can also monitor other parameters of the system such as running processes, file system access and integrity, and user logins for identifying malicious activities. BlackIce Defender and Tripwire are good examples of HIDS. Tripwire is an HIDS tool that automatically calculates the cryptographic hashes of all system files as well as any other files that a network administrator wants to monitor for modifications. It then periodically scans all monitored files and recalculates information to see whether or not the files have been modified. It raises an alarm if changes are detected. Answer option A is incorrect. RADIUS is an industry standard protocol to authenticate, authorize, and account for access server connections. Answer option D is incorrect. Back door is a
program or account that allows access to a system by skipping the security checks. Many vendors and developers implement back doors to save time and effort by skipping the security checks while troubleshooting. Back door is considered to be a security threat and should be kept with the highest security. If a back door becomes known to attackers and malicious users, they can use it to exploit the system Answer option B is incorrect. A Network-based Detection System (NIDS) analyzes data packets flowing through a network. It can detect malicious packets that are designed to be overlooked by a firewall’s simplistic filtering rules. It is responsible for detecting anomalous or inappropriate data that may be considered ‘unauthorized’ on a network. An NIDS captures and inspects all
data traffic, regardless of whether or not it is permitted for checking.