3.1 Describe the Functionality of These Endpoint Technologies in Regard to Security Monitoring Utilizing Rules, Signatures, and Predictive AI 200-201 Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   An organization has a HIDS deployed on all endpoints. The HIDS uses rules to monitor for new services and signature-based detection for known malware. Recently, a legitimate software update installed a new service, triggering a high-priority alert. The analyst wants to prevent similar false positives in the future without losing visibility into unauthorized service installations. Which action is most appropriate?

   • ADisable the rule that monitors for new services.
   • BUse a host-based firewall rule to block the software update process.
   • CCreate a rule exception for the specific software update's service name and path.
   • DIncrease the alert severity threshold so only critical alerts are generated.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security analyst is evaluating a host-based intrusion detection system (HIDS) for a network of Windows servers. The primary requirement is to detect when a critical system file is modified or when a new service is installed, which could indicate compromise. The analyst also wants to detect known malware that might be dropped onto the servers. Which combination of HIDS capabilities is most appropriate?

   • ASignature-based detection only, focusing on network traffic.
   • BBehavioral analysis only, without any rules or signatures.
   • CHost-based firewall rules that block all inbound traffic to the servers.
   • DFile integrity monitoring rules and signature-based detection for known malware.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company's security policy requires that endpoints block all inbound traffic by default, except for remote desktop (RDP) access from a specific admin subnet. The host-based firewall is configured accordingly. A new vulnerability is discovered in the RDP service, and the security team wants to reduce risk without losing remote management capability. Which action best balances security and operational needs?

   • ARestrict the RDP allow rule to the specific admin subnet and require VPN for remote admins
   • BDisable the host-based firewall temporarily until the vulnerability is patched
   • CRemove the RDP allow rule and rely on out-of-band management
   • DChange the RDP port to a non-standard port and keep the allow rule for any source
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst notices that a known malware variant, previously identified by a specific SHA-256 hash, is being blocked by the endpoint protection platform. However, the analyst is concerned that a slightly modified version of the same malware, with a different hash, might evade detection. Which detection mechanism should the analyst verify is enabled to catch the modified variant?

   • AHost-based firewall rules that block outbound connections
   • BHeuristic analysis that examines code behavior and structure
   • CSignature-based detection with updated virus definitions
   • DPredictive AI that models normal user behavior
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security operations center wants to deploy an endpoint protection solution that can identify never-before-seen malware by learning from millions of endpoint events. The solution should improve over time as more data is collected. Which technology is best suited for this requirement?

   • APredictive AI that uses machine learning models trained on historical endpoint behavior.
   • BSignature-based detection with daily updates.
   • CA static rule set that defines known malicious file hashes.
   • DA host-based firewall with application allowlisting.
   Reveal Solution Discussion Select an answer first