Which technology looks at suspicious network traffic going to or from a single host or endpoint?

Which technology looks at suspicious network traffic going to or from a single host or endpoint?

• A. NIDS
• B. Host-Based IDS (HIDS)
• C. API Gateway
• D. NAT Gateways

Answer: (B)

Monitoring suspicious traffic to or from a single endpoint is the domain of a host-based intrusion detection system. It runs on the endpoint itself and watches inbound and outbound network activity, along with host-specific signals like logs and process behavior, for signs of compromise. This focuses on one machine, unlike a network-based IDS, which examines traffic across a broader network segment and may not pinpoint activity tied to a single host. An API gateway handles API requests and security at the application level, not host-level intrusion detection, and NAT gateways perform address translation rather than monitoring for intrusions. So the host-based approach is the best fit for observing traffic related to a single host.

Monitoring suspicious traffic to or from a single endpoint is the domain of a host-based intrusion detection system. It runs on the endpoint itself and watches inbound and outbound network activity, along with host-specific signals like logs and process behavior, for signs of compromise. This focuses on one machine, unlike a network-based IDS, which examines traffic across a broader network segment and may not pinpoint activity tied to a single host. An API gateway handles API requests and security at the application level, not host-level intrusion detection, and NAT gateways perform address translation rather than monitoring for intrusions. So the host-based approach is the best fit for observing traffic related to a single host.