N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Host-based Intrusion Detection System (HIDS)

  Why this is correct

  A Host-based Intrusion Detection System (HIDS) operates directly on an individual endpoint, such as a server or workstation, to monitor its internal activities. It meticulously scrutinizes system calls, application logs, file integrity, registry changes, and running processes for anomalous behavior or known malware signatures. By focusing on the host's internals, HIDS is uniquely positioned to detect malware execution, unauthorized file modifications, or privilege escalation attempts that might bypass network-level defenses.

• ✗

  Network-based Intrusion Detection System (NIDS)

  Why it's wrong here

  A Network-based Intrusion Detection System (NIDS) passively monitors network traffic across a segment, analyzing packet headers and payloads for suspicious patterns, known attack signatures, or policy violations. While effective at identifying network-borne threats like port scans, denial-of-service attacks, or unauthorized protocol usage, NIDS lacks visibility into the internal operations of individual hosts. It cannot inspect system calls, file integrity, or processes running on an endpoint, making it unsuitable for detecting malware already resident and executing on a specific machine.

  When this WOULD be correct

  A question asking for a control that detects malware by analyzing network traffic patterns or signatures, such as 'An analyst wants to detect malware spreading across the network by inspecting packet payloads.'

• ✗

  Firewall

  Why it's wrong here

  A firewall primarily functions as a network security device that enforces access control policies by filtering incoming and outgoing network traffic based on predefined rules. It operates by examining source/destination IP addresses, port numbers, and protocols to permit or deny connections, acting as a preventative barrier. However, a firewall is not designed to detect or analyze internal host activities like system calls, file changes, or the presence of malware executing within a system, as its role is to regulate network flow, not endpoint integrity.

  When this WOULD be correct

  A firewall would be the correct answer if the question asked about a control that filters incoming and outgoing network traffic based on an organization's security policy, such as blocking unauthorized access to a network.

• ✗

  Virtual Private Network (VPN)

  Why it's wrong here

  A Virtual Private Network (VPN) establishes a secure, encrypted tunnel over an untrusted network, such as the internet, to provide confidential and integrity-protected communication between two endpoints or networks. Its primary purpose is to ensure data privacy and secure remote access by encrypting traffic in transit. A VPN does not, however, inspect the content of the endpoints themselves for malware, monitor system calls, or assess file integrity; it merely secures the communication channel, not the host's internal state.

  When this WOULD be correct

  A question asking for a technology that provides secure remote access to an internal network by encrypting traffic between a remote user and the corporate network would have VPN as the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question