3.1 Describe the Functionality of These Endpoint Technologies in Regard to Security Monitoring Utilizing Rules, Signatures, and Predictive AI 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which criteria can a host-based firewall rule use to allow or block traffic?

   • AFile hash, malware signature, and heuristic score
   • BUser authentication method, password policy, and account lockout threshold
   • CSource IP address, destination port, and application name
   • DCPU usage, memory utilization, and disk I/O
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which scenario best demonstrates the use of predictive AI in endpoint security?

   • AA firewall rule blocks all inbound traffic on port 23.
   • BA process is flagged because it attempts to modify system files.
   • CA file is blocked because its hash matches a known malware sample.
   • DAn alert is generated because a user's behavior deviates from their typical login patterns.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst at a mid-sized company needs to detect a known ransomware strain that was recently seen in the wild. The team has the file hash and a unique byte pattern from the malware's payload. The endpoint protection solution is currently configured with only signature-based detection enabled. Which action will most effectively ensure the ransomware is detected on endpoints?

   • ACreate a custom firewall rule to block the ransomware's command-and-control IP address.
   • BEnable heuristic analysis so the endpoint protection can identify the ransomware based on its behavior.
   • CAdd the file hash and byte pattern to the signature database and ensure signature updates are pushed to endpoints.
   • DDisable signature-based detection to avoid false positives and rely on the host-based firewall to stop the malware.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of a host-based firewall?

   • ATo filter incoming and outgoing traffic on a single endpoint based on a set of rules
   • BTo monitor and analyze network traffic across an entire subnet
   • CTo encrypt all data transmitted from the endpoint
   • DTo detect and quarantine malware on the endpoint
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security administrator is configuring endpoint protection for a financial trading firm where low latency is critical. The solution must detect malware without significantly impacting system performance. The firm has a well-maintained signature database and a small number of endpoints. Which detection configuration is most appropriate?

   • AEnable signature-based detection and disable heuristic analysis to minimize performance impact.
   • BDisable all detection and rely on the host-based firewall.
   • CEnable behavioral analysis and disable signature-based detection.
   • DEnable both signature-based and behavioral analysis for maximum coverage.
   Reveal Solution Discussion Select an answer first