3.1 Describe the Functionality of These Endpoint Technologies in Regard to Security Monitoring Utilizing Rules, Signatures, and Predictive AI 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A HIDS is generating a high volume of alerts for a legitimate application that frequently writes to its own configuration files. The analyst wants to reduce false positives while still detecting actual unauthorized modifications. Which approach is most effective?

   • ASwitch the HIDS to signature-based detection only.
   • BIncrease the sensitivity of the behavioral analysis engine.
   • CCreate a rule that excludes the application's known configuration file paths from file integrity monitoring.
   • DDisable all file integrity monitoring rules on the host.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security analyst is troubleshooting why a host-based firewall is not blocking traffic from a known malicious IP address. The firewall has an inbound block rule for that IP, but the traffic is still reaching the application. Which is the most likely cause?

   • AThe malicious IP is using a different protocol than the rule specifies.
   • BThe firewall rule is configured for outbound traffic instead of inbound.
   • CThe firewall is disabled on the endpoint.
   • DThe application is using a port that is not covered by the rule.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How does predictive AI enhance endpoint security monitoring compared to traditional rules and signatures?

   • AIt only works on network traffic, not on endpoint data.
   • BIt uses machine learning models to analyze patterns and anticipate threats that may not match known signatures.
   • CIt replaces the need for any human analysis of security alerts.
   • DIt requires a signature to be created before it can detect a threat.
   Reveal Solution Discussion Select an answer first
5. 34application · easy

   An analyst is reviewing an alert from an endpoint protection tool. The alert indicates that a file was blocked because its SHA-256 hash matched a known malicious file. Which detection method was used?

   • ABehavioral detection
   • BHeuristic detection
   • CPredictive AI
   • DSignature-based detection
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An organization requires that a specific legacy application on a Windows endpoint be allowed to communicate only with a single internal server on TCP port 443. All other inbound and outbound traffic from that application should be blocked. The host-based firewall is managed via Group Policy. Which configuration best meets the requirement?

   • ACreate an inbound allow rule for the server's IP on TCP 443 and leave outbound traffic unrestricted.
   • BCreate an outbound allow rule for the application's executable to the server's IP on TCP 443, and add a default block rule for that application.
   • CBlock all outbound traffic on the endpoint and rely on the application's own settings to allow the connection.
   • DCreate a rule that allows all traffic from the application's executable to any destination on any port.
   Reveal Solution Discussion Select an answer first