200-201 Question 11
Select 3Your organization uses a legacy antivirus solution to protect endpoints. Recently, multiple systems were compromised by a new strain of ransomware, even though the antivirus was fully updated. Which of the following limitations of legacy antivirus solutions likely contributed to the breach?
- A
Dependence on signature-based detection
- B
Inability to analyze unknown file behaviors in real-time
- C
Over-reliance on cloud-based behavioral analysis
- D
Limited capability to detect polymorphic malware
- E
Strong integration with endpoint detection and response (EDR) tools
Show answer and explanation
Correct answers: A, B, D
Explanation
Legacy antivirus solutions are limited by their reliance on signature-based detection, lack of real-time behavior analysis, and inability to effectively deal with polymorphic malware. These limitations make them less effective in addressing modern, sophisticated threats like ransomware.
- A. Correct.
Legacy antivirus solutions primarily rely on signature-based detection, which can only identify known threats. New or modified malware strains often go undetected.
- B. Correct.
Legacy antivirus lacks advanced behavior analysis and typically cannot detect unknown threats in real-time, making it ineffective against new ransomware strains.
- C. Incorrect.
Cloud-based behavioral analysis is typically a feature of modern solutions, not legacy antivirus, and thus is not relevant to this scenario.
- D. Correct.
Polymorphic malware changes its code to evade detection, and legacy antivirus often struggles to identify such dynamic threats.
- E. Incorrect.
Strong integration with EDR tools is a feature of modern security solutions, not legacy antivirus, which primarily operates in isolation.