Which endpoint security capability detects and logs security events on the host?

• A. A cloud service that filters email.
• B. A VPN client for remote access.
• C. Host-Based Intrusion Detection System (HIDS) detects and logs.
• D. A hardware firewall appliance.

Answer: (C)

Detecting and logging security events on the host is the job of a host-based intrusion detection system. This type of security tool runs on the endpoint itself and continuously monitors activities such as file changes, unusual process behavior, and system log entries. When it spots something suspicious, it generates alerts and records events so security teams can investigate and respond, either on the device or within a central log/SIEM system. This is different from cloud email filtering (which protects email traffic), a VPN client (which secures remote access), or a hardware firewall (which protects the network perimeter). Therefore, the host-based intrusion detection system is the capability described.