CompTIA CySA+ Practice Test

Which of the following is a common feature of host-based intrusion protection systems (HIPS)?

1. Real-time monitoring of system activity

2. SSL encryption of network traffic

3. Automated software updates

4. User authentication before login

The correct answer is: Real-time monitoring of system activity

Host-based intrusion protection systems (HIPS) are designed to monitor and respond to suspicious activities on a specific host or device. One of the primary features of HIPS is real-time monitoring of system activity. This capability allows the system to analyze processes, file access, and network connections continuously, enabling it to detect potential security breaches or anomalies as they occur. Real-time monitoring is crucial because it helps in identifying threats immediately, allowing for prompt response measures to be taken before any significant damage or data loss could occur. This proactive approach is central to the effectiveness of HIPS in maintaining the integrity and security of the host system. While SSL encryption of network traffic, automated software updates, and user authentication before login are important security practices, they do not specifically characterize the functionality of host-based intrusion protection systems. SSL is more related to securing data in transit, automated updates focus on maintaining software integrity, and user authentication is essential for access control but does not pertain to the monitoring and protection capabilities intrinsic to HIPS.