5.5 Explain Behavioral Threat Prevention CYBERSECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company has deployed an endpoint protection platform that includes behavioral threat prevention. They also use a separate EDR tool that provides detailed forensic investigation capabilities. How should these two solutions be integrated to provide the most effective layered defense?

   • ARun both solutions independently and compare alerts manually
   • BDisable behavioral threat prevention to avoid false positives
   • CUse behavioral threat prevention for automated containment and EDR for post-incident forensics
   • DReplace the EDR tool with behavioral threat prevention
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is investigating an alert from the behavioral threat prevention system. The alert indicates that a process spawned a child process, which then attempted to enumerate network shares and access the registry. The file's hash is not in any threat database. What does this alert most likely indicate?

   • AThe process is a false positive and can be ignored
   • BThe process is a known malware variant that has been seen before
   • CThe process is likely benign because the hash is not flagged
   • DThe process is exhibiting behavior consistent with lateral movement or reconnaissance
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is deploying a new endpoint protection platform that includes behavioral threat prevention. They also have a network-based intrusion prevention system (IPS) and a SIEM. The security team wants to ensure that when a behavioral threat is detected on an endpoint, the network IPS can also block the associated command-and-control traffic. What is the most effective way to achieve this integration?

   • AUse an API or automated feed to share threat intelligence between the endpoint platform and the IPS
   • BConfigure the SIEM to send alerts to the security team for manual action
   • CDisable the IPS because the endpoint platform already blocks the threat
   • DManually copy the IoCs from the endpoint alert to the IPS
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How does behavioral analysis detect threats on an endpoint?

   • ABy blocking all network traffic to unknown IP addresses
   • BBy comparing file hashes against a database of known malware
   • CBy scanning the hard drive for suspicious file names
   • DBy monitoring and evaluating the activities of processes, users, and system components
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team is evaluating a new endpoint detection tool. They want to detect a polymorphic malware strain that changes its file hash each time it spreads, but consistently performs the same sequence of actions: it creates a scheduled task, modifies the hosts file, and injects code into a legitimate process. Which detection approach would be most effective?

   • AMaintain a database of known malware hashes
   • BMonitor for the behavioral pattern of scheduled task creation, hosts file modification, and process injection
   • CPerform a full disk scan daily to find new files
   • DUse a reputation service to block files from unknown publishers
   Reveal Solution Discussion Select an answer first