3.1 Describe the Functionality of These Endpoint Technologies in Regard to Security Monitoring Utilizing Rules, Signatures, and Predictive AI 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which type of data would a host-based intrusion detection system (HIDS) typically analyze to detect suspicious activity?

   • ASystem logs, file integrity data, and process activity
   • BNetwork packet captures from the switch port
   • CFirewall rule configurations from the perimeter gateway
   • DDNS queries and HTTP requests from the network
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization's antimalware solution is configured to use signature-based detection. A user downloads a file that is a known variant of a Trojan, but the antimalware does not detect it. Which is the most likely reason for the missed detection?

   • AThe file is a zero-day malware with no known signature.
   • BThe signature database is outdated and does not include the variant's hash or pattern.
   • CBehavioral analysis is disabled, so the antimalware cannot detect the file.
   • DThe host-based firewall blocked the download, so the file was not saved.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A workstation is infected with malware that attempts to communicate with an external command-and-control server on TCP port 4444. The security team wants to stop this communication without disrupting the user's ability to browse the web on port 443. Which host-based firewall configuration is most appropriate?

   • AAllow all outbound traffic and rely on the malware's signature to be detected.
   • BBlock all outbound traffic on the workstation.
   • CCreate an inbound block rule for TCP port 4444.
   • DCreate an outbound block rule for TCP port 4444 and allow all other outbound traffic.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team is evaluating endpoint protection for a fleet of servers that run a legacy application. The application is known to perform unusual but legitimate actions, such as writing to system directories and spawning child processes. The team wants to detect malware without disrupting the application. Which detection strategy best balances detection capability and operational stability?

   • AEnable aggressive behavioral blocking for all suspicious actions
   • BDisable all detection mechanisms except host-based firewall rules
   • CRely solely on predictive AI to block any deviation from a learned baseline
   • DUse signature-based detection for known threats and behavioral analysis in a monitoring-only mode
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company deploys a host-based firewall on all employee laptops. A user reports that a legitimate internal application can no longer connect to its server on TCP port 8443. The firewall is configured with a default-deny policy. Which rule should the administrator add to restore connectivity while maintaining security?

   • ADisable the host-based firewall temporarily
   • BAllow inbound TCP from the application server on port 8443
   • CAllow all outbound TCP traffic to any destination
   • DAllow outbound TCP to the application server's IP address on port 8443
   Reveal Solution Discussion Select an answer first