200-201 Question 238
Single answerA security analyst at a small organization notices that multiple endpoints have been infected by a known malware strain. Upon investigation, they discover that the organization’s antivirus software was not updated to the latest virus definition files. What is the most likely reason for the infection, and what can the analyst do to prevent similar incidents in the future?
- A
The antivirus software's heuristic detection failed; the analyst should replace the antivirus software with a more advanced solution.
- B
The antivirus software was not configured for real-time scanning; the analyst should enable real-time scanning on all endpoints.
- C
The antivirus software's virus definition database was outdated; the analyst should ensure regular updates to the virus definitions.
- D
The infected systems were not included in antivirus scans; the analyst should schedule periodic full-system scans on all devices.
Show answer and explanation
Correct answer: C
Explanation
Antivirus software relies heavily on up-to-date virus definition databases to detect and block known malware. If these definitions are outdated, the software cannot recognize new malware strains. In this scenario, the infection is most likely due to the outdated virus definitions. The analyst should implement a process to ensure virus definitions are consistently updated to prevent similar incidents in the future.
- A. Incorrect.
While heuristic detection can fail in some cases, the described issue is explicitly related to outdated virus definitions, not heuristic detection. Replacing the software is unnecessary if regular updates resolve the issue.
- B. Incorrect.
Although real-time scanning is useful, the scenario does not mention that it was disabled. The issue is related to outdated virus definitions rather than the scanning configuration.
- C. Correct.
Outdated virus definitions are the most likely reason for the infection, as antivirus software relies on updated definitions to recognize and block known malware. Ensuring regular updates will address this issue.
- D. Incorrect.
While scheduling full-system scans is good practice, it does not address the root cause of this incident, which is the outdated virus definitions.