3.1 Describe the Functionality of These Endpoint Technologies in Regard to Security Monitoring Utilizing Rules, Signatures, and Predictive AI 200-201 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An endpoint protection product uses signature-based detection with a local cache of file hashes. A user downloads a legitimate file that is not in the cache. The product allows the file to run. Later, the file is found to be malware that was not yet known at the time of download. Which detection mechanism would have been most likely to prevent this execution?

   • AHost-based firewall rules that block downloads from the internet
   • BMore frequent signature updates
   • CBehavioral analysis that monitors the file's actions after execution
   • DA larger local cache of known good file hashes
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   In a host-based intrusion detection system (HIDS), what is the primary difference between rule-based and signature-based detection?

   • ARule-based detection is outdated, while signature-based detection is the modern standard.
   • BRule-based detection is only used for network traffic, while signature-based detection is only used for host logs.
   • CRule-based detection relies on predefined conditions and logic, while signature-based detection matches specific patterns or hashes of known threats.
   • DRule-based detection uses behavioral patterns, while signature-based detection uses known indicators of compromise.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A workstation's host-based firewall is blocking a legitimate application that needs to listen for incoming connections on a high port (e.g., 50000) for a peer-to-peer feature. The firewall uses a default-deny inbound policy. Which configuration change should be made to allow this while minimizing risk?

   • ACreate an inbound allow rule for the specific application executable on TCP port 50000
   • BAdd a rule to allow all inbound TCP traffic on any port
   • CDisable the host-based firewall for the public network profile
   • DCreate an outbound allow rule for the application on TCP port 50000
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A user reports that a legitimate application cannot connect to the internet after a host-based firewall update. The firewall is configured with a default-deny outbound policy and allows only specific applications. The application is not in the allowlist. Which action should the administrator take to restore connectivity while maintaining the security posture?

   • AAdd the application's executable to the firewall's outbound allowlist.
   • BDisable the host-based firewall temporarily.
   • CChange the firewall policy to allow all outbound traffic.
   • DCreate an inbound allow rule for the application.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   An organization is considering adding predictive AI to its endpoint security stack. The SOC currently relies on signatures and simple rules. The team is concerned about the AI generating too many false positives and overwhelming analysts. Which implementation approach would best address this concern while still improving detection of novel threats?

   • AReplace all signature-based detection with predictive AI
   • BKeep signatures and rules and do not deploy predictive AI
   • CDeploy predictive AI in a monitoring-only mode and tune alert thresholds based on SOC feedback
   • DDeploy predictive AI with automatic blocking of all flagged anomalies
   Reveal Solution Discussion Select an answer first