3.1 Describe the Functionality of These Endpoint Technologies in Regard to Security Monitoring Utilizing Rules, Signatures, and Predictive AI 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A HIDS is configured with a rule that triggers an alert when the number of failed login attempts exceeds five within ten minutes. An attacker is using a slow brute-force attack, making only three attempts every ten minutes, and the HIDS is not alerting. The analyst wants to detect this slow attack without increasing false positives from legitimate users who occasionally mistype passwords. Which adjustment is most effective?

   • ADisable the rule and rely on predictive AI to detect the attack.
   • BChange the rule to alert on a lower threshold over a longer time window, such as ten failed attempts in 30 minutes.
   • CUse a host-based firewall to block the attacker's IP after three failed attempts.
   • DIncrease the threshold to ten attempts in five minutes.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security analyst is reviewing the capabilities of a host-based intrusion detection system (HIDS) for deployment on critical servers. Which statement accurately describes the primary function of a HIDS?

   • AIt encrypts data at rest on the host to prevent unauthorized access.
   • BIt monitors network traffic between the server and other hosts to detect intrusions.
   • CIt analyzes logs and system activity on the host to detect suspicious behavior using rules and signatures.
   • DIt blocks malicious traffic by filtering packets based on IP addresses and ports.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A HIDS is configured to alert when a specific system file is modified. The file is changed during a legitimate software update, and the HIDS generates an alert. Which type of detection is responsible for this alert?

   • ARule-based detection that monitors file integrity
   • BBehavioral analysis that identifies the update process as malicious
   • CSignature-based detection that matches the new file hash
   • DPredictive AI that anticipates the update as a threat
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A user's laptop is infected with malware that attempts to communicate with a command-and-control server over an unusual port. The host-based firewall is configured with a default-allow outbound policy. Which configuration change would best prevent this communication while minimizing disruption?

   • AAdd an inbound block rule for the command-and-control server's IP address
   • BChange the outbound policy to default-deny and allow only specific applications
   • CAdd an outbound block rule for the specific malware executable and the unusual port
   • DDisable the host-based firewall
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An endpoint protection product is configured to monitor running processes. A new piece of software attempts to encrypt a large number of user documents and then delete the originals. No signature exists for this software. Which detection capability is most likely to flag this behavior?

   • AHost-based firewall rules that block outbound network traffic
   • BSignature matching against a database of known ransomware hashes
   • CPredictive AI that forecasts future attack campaigns
   • DBehavioral analysis that detects mass file encryption and deletion
   Reveal Solution Discussion Select an answer first