Cisco CyberOps Associate (CBROPS) 200-201Host-Based AnalysisMedium
A security analyst is investigating a suspected zero-day malware infection on a critical Windows server. The EDR solution has detected highly unusual process behavior, including a legitimate system process (`svchost.exe`) making outbound connections to a malicious IP address and creating unusual child processes. Which endpoint security technology is specifically designed to identify and block such novel, behavior-based threats that lack known signatures?
- ABehavioral Analysis (Heuristics/AI)
- BData Loss Prevention (DLP)
- CHost-based Firewall
- DAntivirus (Signature-based)
Show answer & explanationAnswer & explanation
Correct answer: A. Behavioral Analysis (Heuristics/AI)
Behavioral analysis, often powered by heuristics or artificial intelligence/machine learning, is designed to detect anomalous or suspicious actions by processes, even for previously unknown (zero-day) threats, by monitoring patterns of behavior rather than relying on static signatures.
Why the other options are wrong
- B. Data Loss Prevention (DLP) focuses on preventing sensitive data from leaving the organization, not primarily on detecting malware execution or unusual process behavior.
- C. A host-based firewall controls network traffic based on rules but doesn't inherently detect malicious process behavior unless specific rules are violated.
- D. Signature-based antivirus relies on known malware signatures and would likely miss a zero-day threat.
Behavioral Analysis (Endpoint Security)
An endpoint security technique that monitors the actions and patterns of processes and users on a host, looking for deviations from normal behavior to detect unknown or zero-day threats.
- Effective against zero-day and fileless malware.
- Uses heuristics, machine learning, or AI.
- Focuses on 'how' a program acts, not 'what' it is.
Memory trick: To protect an endpoint, you need to 'scan' for known threats, 'control' traffic, and 'watch' for weird behavior.