Question

Which of the following tools would stop a string of 16 NOPs before becoming embedded in OS memory, causing buffer overflow?

HIPS

HIDS

DLP

Nmap

Answer 1

Step 1

option A Explaination

Host based intrusion prevention system (HIPS) is an installed software package which monitors a single host for suspicious activity by analyzing events occurring within that host

• Host Intrusion Prevention Systems are deployed on the end hosts
• Should protect against buffer overflows
• Should protect the underlying operating system
• Should protect against known and unknown attacks .
• HIPS would stop a string of 16 NOPs before becoming embedded in OS memory, causing buffer overflow

Step 2

option B Explaination

A host-based IDS (HIDS) is an intrusion detection system that runs as a service on a hostcomputer system. It is used to monitor the machine logs, system events, and application activity for signs of intrusion. It is useful for detecting attacks that originate outside the organization as well as attacks by internal users logged on to the system.

Step 3

option C Explaination

Data loss prevention (DLP) is a strategy for making sure that end users do not send sensitive or critical information outside the corporate network. The term is also used to describe software products that help a network administrator control what data end users can transfer.

Step 2

option D Explaination

Nmap, short for Network Mapper, is a free, open-source tool for vulnerability scanning and network discovery. Network administrators use Nmap to identify what devices are running on their systems, discovering hosts that are available and the services they offer, finding open ports and detecting security risks.

Option A HIPS is correct one