DSAC Annex F Practice Test

HIPS protects a single machine by actively watching for suspicious or unauthorized actions on that host and blocking them before they cause harm. It runs on the endpoint and monitors activities like system calls, file and registry changes, and program behavior, using signatures and behavior patterns to detect intrusions and halt them in real time. This direct host-level defense—aimed at keeping the computer and its data safe from malware and exploitation—is what the description in the option is capturing.

In contrast, a firewall sits at the network boundary to control traffic between networks, a backup utility preserves data, and a user authentication service handles verifying identities. None of those directly monitor or prevent intrusions on a single host the way HIPS does.