hardMultiple ChoiceObjective-mapped
CISM Practice Question: Has implemented a host-based intrusion prevention…
An organization has implemented a host-based intrusion prevention system (HIPS) on all endpoints. An internal audit reveals that many incidents go undetected because users often disable HIPS when it interferes with applications. Which of the following is the MOST effective control to address this issue?
⚠ Common exam trap
Candidates often choose to remove user privileges (Option C) without realizing that the core issue is application compatibility, not user intent; the most effective control must address the conflict, not just enforce compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement application whitelisting to allow approved applications while HIPS monitors.
Application whitelisting addresses the root cause: users disable HIPS due to false positives or performance issues with legitimate applications. By allowing only approved applications to run, HIPS can monitor without interference, reducing the need for users to disable it. This control maintains endpoint security while ensuring business-critical applications operate smoothly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable HIPS and rely solely on network-based intrusion detection.
Why it's wrong here
This is incorrect because removing HIPS eliminates host-based protection, leaving endpoints vulnerable to attacks that bypass network defenses.
- ✗
Increase the sensitivity of HIPS signatures to detect more threats.
Why it's wrong here
This is incorrect because increasing sensitivity would likely increase false positives, causing users to disable HIPS even more.
- ✗
Remove the ability for users to disable HIPS.
Why it's wrong here
This is incorrect because it does not address the root cause of application compatibility; users may find workarounds or business operations may be disrupted.
- ✓
Implement application whitelisting to allow approved applications while HIPS monitors.
Why this is correct
This is correct because application whitelisting allows approved applications to run without being blocked, reducing false positives and the need for users to disable HIPS.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.