5.2 Explain the Limitations of Signature-Based Anti-Malware Software CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A malware analyst is examining a suspicious file that was flagged by a sandbox but not by the signature-based anti-malware. The analyst finds the file contains a known malicious payload, but it is encrypted with a random key and decrypted only at runtime. Which evasion technique is being used?

   • AMetamorphism
   • BEncryption
   • CObfuscation
   • DPolymorphism
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a 'signature' in the context of signature-based anti-malware?

   • AA digital certificate used to sign legitimate software
   • BA unique identifier, such as a hash, of a known malware sample
   • CA rule that defines normal behavior for an application
   • DA cryptographic key used to encrypt files on the endpoint
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why does signature-based anti-malware require frequent updates?

   • ATo add signatures for newly discovered malware
   • BTo improve the performance of the scanning engine
   • CTo reduce the size of the signature database
   • DTo change the encryption keys used for file scanning
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is investigating a malware infection that was not detected by the signature-based anti-malware. The analyst discovers the malware uses a technique where it changes its code each time it infects a new system, but the core functionality remains the same. Which limitation of signature-based detection is most directly exploited by this technique?

   • AThe anti-malware relies on static signatures, which cannot match the constantly changing code of polymorphic malware.
   • BThe anti-malware database is too large to be updated frequently enough to keep up with the changes.
   • CThe anti-malware does not have a signature for the malware because it was released after the last update.
   • DThe anti-malware only scans files on access, not on a schedule, so it misses the malware when it is dormant.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security architect is reviewing the endpoint protection strategy for a large enterprise. The current solution is signature-based and has a low false-positive rate, but it has missed several zero-day attacks. The architect is considering adding a behavioral-based detection layer. Which trade-off should the architect consider?

   • ABehavioral detection may increase the false-positive rate, requiring more analyst time to investigate alerts.
   • BBehavioral detection will reduce the performance impact on endpoints because it does not require a signature database.
   • CBehavioral detection will only detect malware that has been previously seen, so it will not help with zero-day attacks.
   • DBehavioral detection will eliminate the need for signature updates, reducing operational overhead.
   Reveal Solution Discussion Select an answer first