3.1 Describe the Functionality of These Endpoint Technologies in Regard to Security Monitoring Utilizing Rules, Signatures, and Predictive AI 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   An antimalware product quarantines a suspicious file that matches a known malware signature. Which detection mechanism did the product use?

   • ABehavioral analysis
   • BHeuristic analysis
   • CSignature-based detection
   • DPredictive AI
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team wants to monitor a critical server for unauthorized changes to system files and for suspicious process activity. They need a solution that can detect both known attack patterns and anomalous behavior. Which approach best meets these requirements?

   • ARely solely on antivirus signature updates
   • BUse a network-based intrusion detection system (NIDS) on the server's network segment
   • CDeploy a host-based intrusion detection system (HIDS) with both signature and behavioral rules
   • DEnable only the host-based firewall with strict inbound rules
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A HIDS rule is written to alert when a user account is created outside of business hours. This is an example of which detection method?

   • AHeuristic analysis
   • BPredictive AI
   • CRule-based detection
   • DSignature-based detection
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is evaluating endpoint protection for a research lab that frequently runs custom, in-house compiled tools. These tools often perform actions that resemble malware, such as modifying registry keys and injecting code into processes. The team needs to detect real malware without disrupting legitimate research. Which approach best balances detection and false positives?

   • AUse behavioral detection with a baseline of normal lab activity and allowlist known in-house tools.
   • BDisable behavioral detection and rely solely on signature-based detection.
   • CEnable aggressive heuristic detection on all endpoints to catch any suspicious code.
   • DUse a host-based firewall to block all process injection attempts.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How does heuristic analysis differ from signature-based detection in antimalware software?

   • AHeuristic analysis is only used for network traffic, while signature-based detection is used for files.
   • BHeuristic analysis examines the behavior and characteristics of a file to identify potential threats, while signature-based detection matches exact known patterns.
   • CHeuristic analysis is slower but more accurate than signature-based detection.
   • DHeuristic analysis uses known malware signatures, while signature-based detection looks for suspicious behavior.
   Reveal Solution Discussion Select an answer first