問題文
A laptop is not reachable from the corporate network for two weeks while the user travels. During that period a program modifies a startup entry and writes a file into a system directory. Which endpoint capability is designed to notice that kind of change on the machine itself?
選択肢
- A host-based firewall, because it decides which connections the laptop accepts and keeps a record of every attempt while the machine is away from the network.
- Host-based intrusion detection, because it watches changes to files, settings, and process behavior on the machine where they happen.
- A network intrusion detection sensor at the office edge, because the startup entry has to be fetched from somewhere and the fetch will cross the office edge as soon as the laptop connects again, at which point the sensor will report the modification retroactively.
- A web content filter, because the program was downloaded.