3.1 Describe the Functionality of These Endpoint Technologies in Regard to Security Monitoring Utilizing Rules, Signatures, and Predictive AI 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary limitation of signature-based detection in antimalware software?

   • AIt consumes too many system resources to run on endpoints.
   • BIt only works on Windows operating systems.
   • CIt cannot detect malware that has been modified or is previously unknown.
   • DIt requires an internet connection to function.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is evaluating a predictive AI endpoint solution that claims to detect ransomware before it executes. The solution uses behavioral models trained on millions of ransomware samples. The team is concerned about the AI solution's accuracy and wants to ensure it does not block legitimate applications. Which validation approach is most appropriate?

   • ADisable all other detection methods and rely solely on the AI solution.
   • BUse the AI solution only for alerting, not blocking, to avoid any impact.
   • CRun the AI solution in a test environment with a representative set of legitimate applications and known ransomware samples.
   • DDeploy the AI solution directly to all endpoints without testing.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of a signature-based detection technique?

   • AMonitoring a process for attempts to access the Windows registry
   • BAnalyzing the frequency of system calls to identify anomalies
   • CUsing machine learning to classify files as malicious or benign
   • DComparing a file's SHA-256 hash to a database of known malware hashes
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization wants to improve its endpoint detection capabilities to identify threats that have not been seen before. The current solution relies on signatures and simple rules. Which enhancement would most directly address this gap?

   • AAdd more granular host-based firewall rules
   • BImplement predictive AI that models baseline behavior and flags deviations
   • CDeploy a network-based intrusion prevention system (IPS)
   • DIncrease the frequency of signature updates
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is considering replacing a signature-based endpoint solution with a predictive AI-based solution. The team is concerned about the AI solution's ability to detect known malware that has been seen before. Which approach ensures that the AI solution does not miss known threats?

   • ADeploy the AI solution alongside signature-based detection to maintain coverage of known malware.
   • BUse the AI solution only for alert prioritization, not detection.
   • CConfigure the AI solution to only analyze network traffic, not host behavior.
   • DRemove all signature-based detection and rely solely on AI.
   Reveal Solution Discussion Select an answer first