Endpoint protection that can detect and prevent malicious activity via signature and heuristic pattern matching.

Endpoint protection that can detect and prevent malicious activity via signature and heuristic pattern matching.

• A. UEBA
• B. HIPS
• C. EDR
• D. FIM

Answer: (B)

The main idea here is a protection mechanism that operates on the endpoint to both detect and stop malicious activity using known patterns and behavior-based analysis. This describes a host-based intrusion prevention system. HIPS watches what programs do on the device—monitoring system calls, file operations, process creations, and other actions—and compares them against known malware signatures as well as heuristics that flag suspicious behavior. When a match or risky behavior is detected, it can block the action in real time, preventing the attack from succeeding, and it may generate an alert for further investigation. UEBA focuses on spotting unusual user or entity behavior through analytics, but it isn’t primarily about preventing malicious actions directly on the endpoint through signature or heuristic checks. EDR centers on detecting and responding to threats after they’ve been observed—investigation, containment, and remediation—rather than real-time prevention based on signatures. FIM monitors changes to files to detect tampering, but it doesn’t provide broad, pattern-based prevention of active malicious activity on the endpoint.

The main idea here is a protection mechanism that operates on the endpoint to both detect and stop malicious activity using known patterns and behavior-based analysis. This describes a host-based intrusion prevention system. HIPS watches what programs do on the device—monitoring system calls, file operations, process creations, and other actions—and compares them against known malware signatures as well as heuristics that flag suspicious behavior. When a match or risky behavior is detected, it can block the action in real time, preventing the attack from succeeding, and it may generate an alert for further investigation.

UEBA focuses on spotting unusual user or entity behavior through analytics, but it isn’t primarily about preventing malicious actions directly on the endpoint through signature or heuristic checks. EDR centers on detecting and responding to threats after they’ve been observed—investigation, containment, and remediation—rather than real-time prevention based on signatures. FIM monitors changes to files to detect tampering, but it doesn’t provide broad, pattern-based prevention of active malicious activity on the endpoint.