5.2 Explain the Limitations of Signature-Based Anti-Malware Software CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is deploying a signature-based anti-malware solution to 1,000 endpoints. The security team is concerned about the time it takes to update signatures on all endpoints, especially those on slow network connections. Which approach would best minimize the window of vulnerability across the fleet?

   • AUse a local caching server that stores the latest signatures and distributes them to endpoints on the LAN.
   • BImplement a phased update approach, updating a small group of endpoints first and then the rest.
   • CConfigure endpoints to pull updates directly from the vendor's cloud service as soon as they are available.
   • DUse a centralized update server that pushes signatures to endpoints during off-peak hours.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is evaluating the effectiveness of the current signature-based anti-malware solution. The analyst finds that the solution has a high false-negative rate for malware that uses encryption and packing. The analyst also notes that the signature database is updated daily, but the malware is often released in waves. Which recommendation would best address the root cause of the high false-negative rate?

   • AReduce the size of the signature database to improve scan performance.
   • BImplement a sandboxing solution that detonates suspicious files in a controlled environment.
   • CIncrease the scan frequency on endpoints to catch malware that is dormant.
   • DIncrease the frequency of signature updates to every hour to reduce the window of vulnerability.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is investigating a breach where the anti-malware tool failed to detect the malware. The malware was a known variant, but it had been packed with a custom packer. The team also notes that the signature database was updated two days before the infection. Which combination of factors most likely contributed to the failure?

   • AThe anti-malware tool was configured to skip files larger than a certain size, and the packed malware exceeded that limit.
   • BThe signature database was outdated, and the malware was released after the last update.
   • CThe malware was a zero-day threat that had never been seen before, so no signature existed.
   • DThe malware was packed, changing its file hash, and the signature database did not include a signature for the packed variant.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which technique is used by malware to change its code each time it infects a new system, specifically to evade signature-based detection?

   • AEncryption
   • BPacking
   • CPolymorphism
   • DObfuscation
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A malware analyst is examining a sample that uses a technique where the malware's code is rewritten each time it infects a new host, but the overall functionality remains the same. The analyst also notes that the malware uses a custom encryption routine to hide its payload. Which combination of evasion techniques is being used?

   • AMetamorphism and obfuscation
   • BObfuscation and packing
   • CPolymorphism and encryption
   • DEncryption and metamorphism
   Reveal Solution Discussion Select an answer first