200-201 Question 237
Single answerDuring a cybersecurity investigation, a Security Operations Center (SOC) analyst observes that multiple endpoints in the network are experiencing performance degradation. The analyst suspects malware but finds that the installed antivirus software has not flagged or removed any malicious files. What is the most likely reason for the antivirus software's failure to detect the threat?
- A
The antivirus software's virus definition database is outdated.
- B
The malware uses polymorphic techniques to evade detection.
- C
The antivirus software is configured to scan only removable drives.
- D
The endpoints are infected with a hardware-based rootkit.
Show answer and explanation
Correct answer: A
Explanation
Antivirus software relies heavily on its virus definition database to identify known threats. If the database is outdated, the software may fail to detect newly developed malware, leaving endpoints vulnerable. This is a common cause of antivirus failure in cybersecurity incidents.
- A. Correct.
Outdated virus definitions prevent antivirus software from recognizing and flagging newer malware, as it relies on up-to-date patterns for detection.
- B. Incorrect.
Polymorphic malware can change its code to evade detection, but antivirus software typically has heuristics to handle such cases, so this is less likely than outdated definitions.
- C. Incorrect.
While incorrect configurations can limit antivirus capabilities, this scenario does not provide evidence that scanning was restricted to removable drives.
- D. Incorrect.
Hardware-based rootkits are rare and would not explain a widespread failure across multiple endpoints, especially if there is no evidence of advanced persistent threats.