During a penetration test in a hypervisor

the security engineer is able to use a script to inject a malicious payload and access the host filesystem. Which of the following best describes this vulnerability?

An administrator at a small business notices an increase in support calls from employees who receive a blocked page message after trying to navigate to a spoofed website. Which of the following should the administrator do?

Implement security awareness training.

Deploy multifactor authentication.

Decrease the level of the web filter settings.

Implement security awareness training.

Update the acceptable use policy.

CompTIA Security+ SYO 701 Practice Test

Q 1 / 57 00:00

00:00 Elapsed

Question 1

A company's antivirus solution is effective in blocking malware but often has false positives. The security team has spent a significant amount of time on investigations but cannot determine a root cause. The company is looking for a heuristic solution. Which of the following should replace the antivirus solution?

Your Answer: Option(s)

Correct Answer: Option(s) B

Rationale

EDR is the best replacement for the antivirus solution.

Endpoint Detection and Response (EDR) systems provide advanced threat detection, investigation, and response capabilities that can address the limitations of traditional antivirus solutions. EDR technologies not only block malware but also reduce false positives by leveraging behavioral analysis and contextual information to improve threat identification.

A) SIEM
Security Information and Event Management (SIEM) solutions aggregate and analyze security data from across the organization but primarily focus on logging, monitoring, and compliance rather than directly addressing malware threats. While SIEM can provide valuable insights, it does not actively respond to threats or reduce false positives in the same way EDR does.

B) EDR
As mentioned, EDR systems excel in detecting and responding to threats at the endpoint level. They analyze behavioral patterns and contextual data to minimize false positives, making them a more effective solution for organizations struggling with traditional antivirus limitations. EDR also provides robust incident response capabilities that can streamline investigations.

C) DLP
Data Loss Prevention (DLP) solutions are designed to protect sensitive data from unauthorized access or exfiltration. Although DLP contributes to overall security posture, it does not address malware threats directly and is not a suitable replacement for an antivirus solution focused on malware detection and response.

D) IDS
Intrusion Detection Systems (IDS) monitor network traffic for suspicious activity but do not actively respond to detected threats. While they can provide alerts on potential issues, IDS solutions lack the proactive response capabilities and endpoint focus that EDR systems provide, making them less effective in replacing a traditional antivirus solution.

Conclusion
In replacing the company's antivirus solution with an appropriate heuristic approach, EDR emerges as the optimal choice due to its ability to reduce false positives through advanced threat detection and response capabilities. Unlike SIEM, DLP, or IDS, EDR directly addresses malware threats at the endpoint, providing a more integrated and effective security solution. This shift can enhance overall security operations and streamline investigation efforts.

Select an answer to continue →

0% score

0/0 correct

Answered 0/57

Correct 0

Wrong 0

57 left

Unlock Full Access

All questions, explanations & stats

Subscribe Now

Poker Exams is an independent exam-preparation site. We are not affiliated with, endorsed by, or sponsored by ATI, TEAS, Elsevier, or any other exam body, school, or certification provider. Exam and product names are trademarks of their respective owners and are used here only to identify the exams our practice materials cover.

EDR is the best replacement for the antivirus solution.

The security engineer is able to use a script to inject a malicious payload and access the host filesystem.

Implement security awareness training.

Hashing is the most effective strategy for protecting sensitive data at rest in a database.

Watering hole attack has occurred.

Free Preview Ended

Unlock Full Access

EDR is the best replacement for the antivirus solution.

The security engineer is able to use a script to inject a malicious payload and access the host filesystem.

Implement security awareness training.

Hashing is the most effective strategy for protecting sensitive data at rest in a database.

Watering hole attack has occurred.

Free Preview Ended

Unlock Full Access

You are leaving this quiz

You're in the middle of a quiz

Report an Issue

Rate this Practice Test