Exam SY0-601 topic 1 question 243 discussion

A host-based intrusion detection and prevention system (HIPS) is a tool that monitors for changes to key files and network traffic on a device

HIPS is the best tool to address both detection and prevention on endpoints. HIPS is an endpoint security solution that monitors and analyzes activity on individual hosts (endpoints) and takes action to prevent or block any suspicious or malicious activities. It can monitor changes to key files, network traffic, and other activities on the device, and can take preventive actions, such as blocking or quarantining malicious files or network connections.

I choose B because the question is about Endpoints. Only HIPS fits into that requirement.

HIPS files and network attacks. NGFW network attacks.

On the "Device" =Host. So HIDs

The answer is HIPS. "...on the device" is the giveaway.

a deep-packet inspection firewall that moves beyond port/protocol inspection and blocking. adds application-level inspection, intrusion prevention, and brings intelligence from outside the firewall

It's HIPS

The best tool for monitoring changes to key files and network traffic on a device, as well as providing detection and prevention capabilities, is a host-based intrusion prevention system (HIPS). A HIPS monitors changes to key files and network traffic on a single device, and can detect and prevent malicious activities by comparing the current state of the system to a known good state. In contrast, a network-based intrusion detection system (NIDS) only monitors network traffic for signs of malicious activity and does not provide prevention capabilities. An antivirus (AV) program only detects and removes malware from a device, and does not monitor changes to key files or network traffic. A next-generation firewall (NGFW) monitors and controls network traffic, but does not provide the detailed monitoring and prevention capabilities of a HIPS.

why not d, next gen firewall?

Why not a NIDS? A network-based intrusion detection system (NIDS) detects malicious traffic on a network. NIDS usually require promiscuous network access in order to analyze all traffic, including all unicast traffic.

A host-based intrusion prevention system (HIPS) is a system or a program employed to protect critical computer systems containing crucial data against viruses and other Internet malware. Starting from the network layer all the way up to the application layer, HIPS protects from known and unknown malicious attacks.