5.5 Explain Behavioral Threat Prevention CYBERSECURITY-PRACTITIONER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which mechanism is commonly used in behavioral threat detection to run suspicious files in an isolated environment?

   • ASandboxing
   • BFirewall rule inspection
   • CDisk encryption
   • DSignature matching
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company's endpoint protection platform detects a process that is encrypting files and displaying a ransom note. The platform's automated response is configured to 'contain' the threat. However, the security team is concerned that the containment action might disrupt a legitimate business application that uses similar encryption for data protection. What should the security team do to balance security and business continuity?

   • AConfigure an exception for the legitimate application's behavior
   • BSwitch to manual response mode for all alerts
   • CDisable the containment action to avoid disrupting the business application
   • DAllow the containment to proceed and restore the business application from backup
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A behavioral threat prevention system detects a process that is attempting to modify the boot configuration and create a new service. The system automatically takes action. Which response is most likely to be triggered?

   • ADisable the network adapter to prevent communication
   • BSend an alert to the security team and wait for manual approval
   • CBlock the process from executing and quarantine the file
   • DRoll back the changes and restore the original boot configuration
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team is evaluating a behavioral threat prevention solution. They want to detect malware that uses obfuscation to hide its code, but the malware still performs the same actions: it modifies the hosts file and disables security tools. Which mechanism would be most effective?

   • ASignature-based detection
   • BHeuristic analysis
   • CHash-based reputation lookup
   • DNetwork traffic analysis
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team is evaluating a new behavioral threat prevention solution. They have a mix of Windows and Linux endpoints, and they need to detect threats that use legitimate system tools like PowerShell and Bash. The solution must also integrate with their existing SIEM for centralized logging. Which capability is most important for the solution to have?

   • ASupport for multiple operating systems and scripting languages
   • BA large database of known malware hashes
   • CThe ability to block all network traffic from unknown IPs
   • DA user-friendly dashboard for manual analysis
   Reveal Solution Discussion Select an answer first