ISC2 Certified in Cybersecurity (CC) Practice Question

A host-based intrusion detection system runs directly on an individual computer, giving it visibility into resources that are not exposed to network sensors. Because it operates inside the operating system, it can review local security and application log files and perform file-integrity checks to spot unauthorized alterations to system binaries or configuration files. Network IDS devices, in contrast, examine packets in transit across network segments, so they lack direct access to a host's internal logs or file system. Blocking traffic with access control lists is a firewall or router function, and establishing encrypted tunnels is the role of a VPN solution rather than any form of IDS. Therefore, monitoring OS logs and detecting local file changes is the distinguishing feature of HIDS.