3.1 Describe the Functionality of These Endpoint Technologies in Regard to Security Monitoring Utilizing Rules, Signatures, and Predictive AI 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which scenario best illustrates behavioral detection in antimalware software?

   • AA file is flagged because it was downloaded from an untrusted website.
   • BA program is flagged because it attempts to encrypt many files in a short time.
   • CA file is flagged because it contains a string that appears in a malware database.
   • DA file is flagged because its hash matches a known malware sample.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An endpoint protection product on a user's laptop is configured to use signature-based, heuristic, and behavioral detection. A new, unknown executable attempts to run and immediately starts encrypting many files and making outbound connections. Which detection mechanism is most likely to trigger an alert first?

   • ASignature-based detection that matches the executable's file hash.
   • BHeuristic detection that analyzes the executable's code structure before execution.
   • CHost-based firewall that blocks outbound connections.
   • DBehavioral detection that monitors the executable's actions in real time.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An endpoint protection solution is configured to quarantine files that match known malware signatures. A user reports that a legitimate application is being quarantined because it contains a code snippet that matches a signature used by a known malware family. Which detection mechanism is most likely causing this false positive?

   • ASignature-based detection that matches byte patterns in the file
   • BBehavioral analysis that monitors the application's runtime actions
   • CHeuristic analysis that evaluates the file's structure
   • DPredictive AI that models normal application behavior
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A host-based firewall is configured to block all inbound traffic on port 22. What is the immediate effect on the endpoint?

   • AAll network traffic on the endpoint is blocked.
   • BThe endpoint can no longer initiate SSH connections to other hosts.
   • CRemote hosts can no longer establish SSH connections to the endpoint.
   • DThe endpoint's SSH service is disabled.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which antimalware detection method is most effective at identifying a brand-new malware strain that has never been seen before?

   • AHeuristic and behavioral analysis
   • BFile hash matching
   • CRule-based log analysis
   • DSignature-based detection
   Reveal Solution Discussion Select an answer first