ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Behaviour-based (also called anomaly or heuristic) HIPS engines monitor system calls, process behavior, registry changes, and other host activities to create a baseline of normal operation. Because they look for deviations from this baseline rather than matching events against a fixed library of known attack signatures, they can detect previously unseen or zero-day exploits. Signature-based engines are fast and accurate for known threats but cannot recognize novel attacks; they also require continuous signature updates and still miss zero-days. Relying solely on network IPS or disabling the behavioral engine would leave hosts blind to local, fileless, or encrypted attacks that never cross the network. Combining both engines without tuning the behavioral component increases the chance of alerts during routine patching and software changes. Therefore, enabling the behavior-based (anomaly) detection engine while tuning its baseline to the servers' normal patching and utility execution patterns offers the best balance of zero-day visibility with controlled false positives.