3.1 Describe the Functionality of These Endpoint Technologies in Regard to Security Monitoring Utilizing Rules, Signatures, and Predictive AI 200-201 Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   A new piece of malware is spreading in the wild. It uses a previously unseen technique to inject code into running processes. Traditional signature-based antivirus is not detecting it. Which additional detection layer would be most effective at identifying this threat?

   • ABehavioral analysis that monitors process injection attempts
   • BHost-based firewall rules that block outbound connections
   • CPredictive AI that forecasts future malware campaigns
   • DSignature updates that include the new malware's hash
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security team wants to improve detection of zero-day malware that does not match any known signature. They have a large dataset of endpoint activity logs and want a solution that can learn normal behavior patterns and flag deviations that might indicate a new threat. Which approach best addresses this need?

   • AIncrease the frequency of signature database updates to ensure the latest known malware is covered.
   • BDeploy a predictive AI model that analyzes endpoint behavior patterns and flags anomalies that deviate from established baselines.
   • CConfigure the host-based firewall to block all inbound connections from unknown IP addresses.
   • DManually review all endpoint logs on a weekly basis to identify suspicious activity.
   Reveal Solution Discussion Select an answer first