Which defense on a host uses both signatures and heuristic detection to stop threats in real time?

Which defense on a host uses both signatures and heuristic detection to stop threats in real time?

• A. EDR
• B. HIPS
• C. FIM
• D. UEBA

Answer: (B)

The defense on a host that uses both signatures and heuristic detection to stop threats in real time is the Host-based Intrusion Prevention System. It sits directly on the endpoint and actively monitors what the system is doing, looking for known malicious patterns (signatures) and for suspicious behavior that deviates from normal operations (heuristics). When a match is found, it can block the action immediately—preventing a malware execution, stopping a suspicious file write, or blocking a hijacked process—before any damage occurs. Signatures rely on a database of known threats, so they quickly identify familiar malware. Heuristics, on the other hand, analyze behavior rather than the exact code, catching novel or obfuscated threats that don’t yet have a signature. The combination enables real-time prevention rather than just detection or alerting. EDR focuses more on detection, telemetry, and post-incident response across endpoints, with prevention often not its primary function. FIM watches for changes to files to detect tampering but doesn’t inherently prevent those changes in real time. UEBA analyzes user and entity behavior to flag anomalies, not necessarily to block on the host as events occur.

The defense on a host that uses both signatures and heuristic detection to stop threats in real time is the Host-based Intrusion Prevention System. It sits directly on the endpoint and actively monitors what the system is doing, looking for known malicious patterns (signatures) and for suspicious behavior that deviates from normal operations (heuristics). When a match is found, it can block the action immediately—preventing a malware execution, stopping a suspicious file write, or blocking a hijacked process—before any damage occurs.

Signatures rely on a database of known threats, so they quickly identify familiar malware. Heuristics, on the other hand, analyze behavior rather than the exact code, catching novel or obfuscated threats that don’t yet have a signature. The combination enables real-time prevention rather than just detection or alerting.

EDR focuses more on detection, telemetry, and post-incident response across endpoints, with prevention often not its primary function. FIM watches for changes to files to detect tampering but doesn’t inherently prevent those changes in real time. UEBA analyzes user and entity behavior to flag anomalies, not necessarily to block on the host as events occur.