Discuss ISC2 CISSP Exam Topic 5 Question 102

Host-Based Intrusion Protection (HIPS) systems are often deployed in monitoring or learning mode during their initial implementation. What is the objective of starting in this mode?

AAutomatically create exceptions for specific actions or files

BDetermine which files are unsafe to access and blacklist them

CAutomatically whitelist actions or files known to the system

DBuild a baseline of normal or safe system events for review

Suggested Answer: A

A Host-Based Intrusion Protection (HIPS) system is a software that monitors and blocks malicious activities on a single host, such as a computer or a server.A HIPS system can also prevent unauthorized changes to the system configuration, files, or registry12

During the initial implementation, a HIPS system is often deployed in monitoring or learning mode, which means that it observes the normal behavior of the system and the applications running on it, without blocking or alerting on any events.The objective of starting in this mode is to automatically create exceptions for specific actions or files that are legitimate and safe, but may otherwise trigger false alarms or unwanted blocks by the HIPS system34

By creating exceptions, the HIPS system can reduce the number of false positives and improve its accuracy and efficiency. However, the monitoring or learning mode should not last too long, as it may also expose the system to potential attacks that are not detected or prevented by the HIPS system.Therefore, after a sufficient baseline of normal behavior is established, the HIPS system should be switched to a more proactive mode, such as alerting or blocking mode, which can actively respond to suspicious or malicious events

Get Premium CISSP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

35 comments · newest first

Blair 10 months ago

Sounds too simple, are we sure that's the goal?

Salley 10 months ago

No way, it's definitely about monitoring first!

Kaitlyn 10 months ago

Wait, I thought it was to automatically whitelist actions?

Lorrie 10 months ago

It's all about building a baseline of normal events.

Rosann 10 months ago

Totally agree, D is the right answer!

Rodney 11 months ago

I thought the purpose was to create exceptions for specific actions, but now I’m questioning if that’s really the right approach in the initial phase.

Glory 11 months ago

I’m leaning towards option D because it seems logical to establish what’s normal before making any changes, but I could be mixing it up with something else we studied.

Marylin 11 months ago

I remember a practice question about HIPS that mentioned whitelisting actions, but I feel like the focus here is more on understanding normal behavior first.

Mel 11 months ago

I think starting in monitoring mode helps to build a baseline of normal activities, but I'm not entirely sure if that's the main goal.

Darell 12 months ago

I feel pretty confident about this one. The objective of starting a HIPS system in monitoring or learning mode is to build a baseline of normal system events. This baseline can then be used to detect and flag any deviations from normal activity, which could indicate a potential intrusion or security breach.

Veronika 12 months ago

I'm a little confused by the options here. Is the goal to automatically create exceptions, or to blacklist unsafe files, or to whitelist known actions? I'll need to re-read the question and think about the purpose of HIPS systems in general.

Samira 12 months ago

Okay, I've got it! The objective is to build a baseline of normal or safe system events that the HIPS system can use as a reference. This allows it to identify and flag any abnormal or potentially malicious activity in the future. Makes sense!

Onita 1 year ago

Hmm, I'm a bit unsure about this one. Is the objective to automatically create exceptions or whitelist known actions? Or is it to identify unsafe files to blacklist? I'll need to think this through carefully.

Delisa 1 year ago

This seems like a straightforward question about the purpose of HIPS systems in monitoring or learning mode. I think the key is to understand that the goal is to build a baseline of normal system activity to use as a reference point.

Frank 1 year ago

Ha! HIPS in 'learning mode' - it's like putting a newborn baby in charge of home security. Gotta crawl before you can walk, am I right?

Jose 1 year ago

↳ replying to Frank

D) Build a baseline of normal or safe system events for review

Tammy 1 year ago

↳ replying to Frank

C) Automatically whitelist actions or files known to the system

Mitsue 1 year ago

↳ replying to Frank

A) Automatically create exceptions for specific actions or files

Alona 1 year ago

I think it's important to determine which files are unsafe to access and blacklist them during initial implementation.

Willie 1 year ago

I believe it also helps in automatically whitelisting actions or files known to the system.

Jamal 1 year ago

I'm going with D. Baseline building is key to understand normal system activity before the HIPS can start enforcing policies effectively.

France 1 year ago

↳ replying to Jamal

Whitelisting known safe actions or files can also help reduce false positives when the HIPS is fully operational.

Lucy 1 year ago

↳ replying to Jamal

Once the baseline is built, it's easier to identify and respond to abnormal activities.

Aleshia 1 year ago

↳ replying to Jamal

I agree, starting in learning mode helps establish what normal system events look like.

Albina 1 year ago

I agree with Erasmo. Starting in learning mode helps in understanding what is normal for the system.

Chaya 1 year ago

C) Automatically whitelist actions or files known to the system - that's a good approach too, but it doesn't really establish the baseline, which is crucial for HIPS.

Ruth 1 year ago

↳ replying to Chaya

A) Automatically create exceptions for specific actions or files

Tonette 1 year ago

↳ replying to Chaya

C) Automatically whitelist actions or files known to the system

Ernie 1 year ago

↳ replying to Chaya

D) Build a baseline of normal or safe system events for review

King 1 year ago

↳ replying to Chaya

A) Automatically create exceptions for specific actions or files

Erasmo 1 year ago

I think the objective is to build a baseline of normal system events for review.

Danica 1 year ago

D) Build a baseline of normal or safe system events for review - this makes total sense for initial HIPS deployment. Gotta learn the normal behavior first before taking action.

King 1 year ago

↳ replying to Danica

D) Build a baseline of normal or safe system events for review

Malcom 1 year ago

↳ replying to Danica

C) Automatically whitelist actions or files known to the system

Elden 1 year ago

↳ replying to Danica

A) Automatically create exceptions for specific actions or files

ISC2 CISSP Exam - Topic 5 Question 102 Discussion