200-201 Question 182
Select 3A cybersecurity analyst is investigating multiple reports of a new strain of malware spreading within the organization. The analyst observes that the malware evades detection by traditional signature-based antivirus software. Which of the following measures should the analyst consider to improve malware detection and response?
- A
Implement endpoint detection and response (EDR) to monitor and analyze suspicious behaviors in real-time.
- B
Update the antivirus software to the latest version and signatures.
- C
Disable antivirus software temporarily to avoid false positives during the investigation.
- D
Deploy heuristic-based detection to identify malicious patterns and behaviors.
- E
Rely solely on user education and awareness programs to prevent malware infections.
Show answer and explanation
Correct answers: A, B, D
Explanation
In this scenario, signature-based antivirus alone is insufficient due to the malware's evasion techniques. Combining updated antivirus software with heuristic detection and advanced tools like EDR provides a multi-layered defense. Disabling antivirus software exposes systems to further risks, and relying solely on user education does not address the technical nature of the threat.
- A. Correct.
Endpoint detection and response (EDR) provides advanced monitoring and behavior analysis, which is effective against malware that evades signature-based detection.
- B. Correct.
Updating antivirus software ensures that the latest known malware signatures are available, improving its effectiveness against newly detected threats.
- C. Incorrect.
Disabling antivirus software is not recommended as it exposes the system to further compromise and reduces protection during an investigation.
- D. Correct.
Heuristic-based detection analyzes the behavior and patterns of files, which can help detect unknown or polymorphic malware.
- E. Incorrect.
While user education is important, relying solely on it without technical controls is insufficient for effective malware prevention or detection.