Which technology is designed to monitor a single server for malicious activity and can stop it on the host if detected?

• A. IDS
• B. SIEM
• C. IPS
• D. HIPS

Answer: (D)

Monitoring a single server for malicious behavior and stopping it on the host is a host-based prevention capability. A Host-based Intrusion Prevention System runs on the individual server and watches for suspicious activity at the system and application level, such as unusual process creation, file or registry changes, or unauthorized access attempts. When it detects something malicious, it can block the action in real time, terminate processes, or tighten controls directly on that machine, stopping the threat where it originated.

An IDS provides detection and alerts about potential attacks, but it typically doesn’t automatically prevent or halt activity on the host. A SIEM gathers and correlates logs from many sources to provide broader visibility and incident response, not real-time host blocking. An IPS focuses on inspecting and blocking traffic at the network level, preventing threats from traversing the network path rather than controlling the behavior of a single host’s processes.