5.5 Explain Behavioral Threat Prevention CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is reviewing an alert from the behavioral threat prevention system. The alert was triggered because a process attempted to modify the Windows registry and create a new service. The process is signed by a reputable software vendor, and its hash matches a known-good file. The analyst must decide whether to allow or block the process. What is the most appropriate course of action?

   • AIgnore the alert because the process is signed and known-good
   • BBlock the process immediately because it is modifying the registry
   • CAllow the process because it is signed and has a known-good hash
   • DInvestigate the context of the behavior, such as the parent process and command-line arguments, before deciding
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is comparing two detection methods for a new malware strain. Method A uses a list of known malicious file hashes. Method B uses a machine learning model that analyzes the sequence of system calls a process makes. The malware is polymorphic and changes its hash each time it infects a new system. Which method will be more effective, and why?

   • ABoth methods are equally effective because they both rely on static indicators
   • BMethod A, because hashes are more reliable than system call analysis
   • CNeither method will be effective because polymorphic malware cannot be detected
   • DMethod B, because it analyzes behavior that remains consistent despite the changing hash
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is comparing two detection methods. Method A flags a file because its hash matches a known malware sample. Method B flags a process because it attempts to access the Security Account Manager (SAM) database and then injects code into another process. Which statement best describes the difference?

   • AMethod A uses static IoCs; Method B uses behavioral indicators
   • BMethod A uses behavioral indicators; Method B uses static IoCs
   • CBoth methods use behavioral indicators
   • DBoth methods use static IoCs
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A user's endpoint is flagged by behavioral threat prevention after it detects a process repeatedly encrypting files and attempting to contact a command-and-control server. The endpoint protection platform automatically contains the threat. Which remediation action is most likely to be taken first?

   • ATerminate the malicious process and quarantine the affected files
   • BRestore the system from a full backup
   • CDisable the user's account
   • DReboot the endpoint to clear memory
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst notices that a known-good application has been modified to include a new module that attempts to enumerate local user accounts and then write to the Windows registry. The file's hash matches a known-good signature, and no network indicators are present. Which behavioral detection mechanism would most likely flag this activity?

   • AMachine learning-based classification of the file's static properties
   • BHeuristic analysis of runtime behavior
   • CReputation-based lookup of the file's publisher
   • DStatic hash-based signature matching
   Reveal Solution Discussion Select an answer first