5.2 Explain the Limitations of Signature-Based Anti-Malware Software CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   Which type of malware is signature-based detection least likely to identify?

   • AA well-known worm that has been in the wild for years
   • BA zero-day exploit that has never been seen before
   • CAn old virus that is no longer active
   • DA common Trojan that is widely distributed
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A malware analyst is reverse-engineering a sample that evaded signature-based detection. The analyst finds that the malware's code is heavily obfuscated, with variable names and control flow altered to make it unique. Which evasion technique is this?

   • AObfuscation
   • BPolymorphism
   • CMetamorphism
   • DEncryption
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How does signature-based anti-malware software primarily identify known malware?

   • ABy monitoring network traffic for malicious command-and-control patterns
   • BBy using machine learning to classify files based on their characteristics
   • CBy comparing file patterns or hashes against a database of known malware signatures
   • DBy analyzing the behavior of programs in a sandbox environment
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst at a mid-sized company notices that a new strain of ransomware is spreading through the network. The anti-malware product, which relies on signature-based detection, has not yet flagged the files. The analyst suspects the malware is using a known exploit but with a modified payload. What is the most likely reason the signature-based tool is failing to detect this threat?

   • AThe anti-malware product is configured to only scan files on write, not on read, so it misses the malware when it is executed.
   • BThe malware is a zero-day threat that has never been seen before, so no signature exists in the database.
   • CThe malware is using a polymorphic engine that changes its code with each infection, so no static signature matches.
   • DThe anti-malware database is too large, causing the scanning engine to skip files that are not in the most recent update.
   Reveal Solution Discussion Select an answer first