5.5 Explain Behavioral Threat Prevention CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization is concerned about ransomware that uses legitimate system tools like PowerShell to execute malicious scripts. The security team wants to detect this without relying on known file signatures. Which combination of behavioral mechanisms would be most effective?

   • ANetwork traffic analysis and firewall rules
   • BUser behavior analytics and email filtering
   • CHash-based signature matching and reputation lookup
   • DSandboxing and machine learning
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company's endpoint protection platform has behavioral threat prevention enabled. An alert is triggered for a process that is attempting to access the LSASS process memory, which is a common credential theft technique. The platform's automated response is set to 'contain'. However, the security team is concerned that the containment action might also block a legitimate security tool that also accesses LSASS for monitoring purposes. What is the best way to handle this situation?

   • ADisable the containment action for all LSASS access alerts
   • BAllow the containment to proceed and then whitelist the security tool after the fact
   • CChange the response to 'alert only' for all behavioral alerts
   • DCreate an exception for the legitimate security tool's specific process path and hash
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which action is an example of a remediation step that behavioral threat prevention might automatically perform?

   • ADeleting the user's profile
   • BQuarantining the malicious file
   • CUpdating the operating system
   • DChanging the user's password
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which combination of endpoint security features best illustrates layered defense with behavioral threat prevention?

   • ADisk encryption and password manager
   • BAntivirus, firewall, and behavioral threat prevention
   • CBackup software and patch management
   • DVPN and network monitoring
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A behavioral threat prevention system detects a process that is attempting to disable the Windows Defender service and delete volume shadow copies. The system automatically responds. Which response is most likely to be triggered?

   • AQuarantine the process and restore the deleted volume shadow copies
   • BReboot the system to clear the threat from memory
   • CSend an alert to the security team and wait for instructions
   • DDisable the user account that is running the process
   Reveal Solution Discussion Select an answer first