5.2 Explain the Limitations of Signature-Based Anti-Malware Software CYBERSECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which operational constraint is a direct result of the signature database growing larger over time?

   • AImproved detection of zero-day malware
   • BReduced memory usage on the endpoint
   • CDecreased need for frequent updates
   • DIncreased performance impact on endpoints during scans
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is evaluating a new anti-malware solution and wants to understand how it detects known malware. The vendor explains that the solution compares file hashes against a database of known malicious hashes. Which detection mechanism is this?

   • AMachine learning classification
   • BHeuristic analysis
   • CSignature-based detection
   • DBehavioral monitoring
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How does obfuscation help malware evade signature-based detection?

   • ABy altering the code's appearance while preserving its functionality, so it does not match known signatures
   • BBy deleting the signature database from the endpoint
   • CBy changing the file's hash to match a known benign file
   • DBy encrypting the malware with a key that changes each time
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security architect is designing a defense-in-depth strategy for a financial institution. The current anti-malware solution is signature-based and has been effective against known threats, but the architect is concerned about zero-day attacks. The institution has a strict budget and cannot afford a full EDR solution. Which additional control would best mitigate the risk of zero-day malware while staying within budget?

   • AIncrease the frequency of signature updates to every hour.
   • BEnable the anti-malware's heuristic detection feature, which looks for suspicious behavior.
   • CImplement application whitelisting to only allow approved executables to run.
   • DDeploy a network-based intrusion detection system (IDS) to monitor for malicious traffic.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security administrator notices that a known malware sample is not being detected by the endpoint protection tool, even though the signature database is up to date. The administrator suspects the malware has been modified to avoid detection. Which technique would most likely allow the malware to evade the signature-based detection?

   • AThe malware is stored on a network share, so the endpoint scanner does not scan it.
   • BThe malware is stored in a password-protected archive, so the scanner cannot read it.
   • CThe malware uses a packer to compress and encrypt its code, changing its file hash.
   • DThe malware is signed with a valid digital certificate, so the scanner trusts it.
   Reveal Solution Discussion Select an answer first