hardMultiple SelectObjective-mapped
200-201 Practice Question: Which TWO characteristics are typical of…
Which TWO characteristics are typical of host-based intrusion detection systems (HIDS) compared to network-based intrusion detection systems (NIDS)?
⚠ Common exam trap
Cisco often tests the misconception that HIDS are better at detecting network attacks or scaling to many devices, but the key differentiator is that HIDS provide host-level visibility (like registry and file changes) and can inspect decrypted traffic, while NIDS are network-focused and cannot see internal host events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Visibility into local system events such as file system changes and registry modifications.
HIDS are installed directly on a host and have direct access to the host's operating system, allowing them to monitor local system events such as file system changes, registry modifications, and process activity. This granular visibility is a key advantage over NIDS, which only sees network traffic and cannot inspect internal host state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Better suited for protecting a large number of devices simultaneously.
Why it's wrong here
NIDS is typically better for broad coverage.
- ✓
Visibility into local system events such as file system changes and registry modifications.
Why this is correct
HIDS monitors host-specific activities.
- ✓
Ability to inspect encrypted traffic at the host level.
Why this is correct
HIDS can see decrypted traffic on the host.
- ✗
Less susceptible to host-based attacks.
Why it's wrong here
HIDS runs on the host and can be disabled if the host is compromised.
- ✗
Lower latency in detecting network attacks.
Why it's wrong here
HIDS may have higher latency due to local processing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.