Antivirus
The four detection methods (signature, heuristic, behavioural, sandbox), quarantine, false positives and false negatives, updating the databases, an antivirus's limits and what an EDR adds.
- 27 cards
- 6 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- The numbers
- Scenarios
- Understand
A few cards from the deck
Signature-based detection: what is it?
Show the answer
A method that compares a file to a database of fingerprints or patterns of already catalogued malicious software.
Reliable and fast on the known, blind to the new: code changed by a single byte can change its fingerprint and escape the database.
An unknown program encrypts 1,200 files in the Documents folder in one minute, then deletes the system's shadow copies. Which detection method spots it best?
- Behavioural detection, which sees what the program does
- Signature detection, which compares the file to a database
- A check of the file's extension before it runs
- A stateful firewall that tracks the program's connection
Show the answer
Behavioural detection, which sees what the program does
The program is unknown, so no signature knows it. Its behaviour, however, is typical of ransomware: mass encryption and destruction of local backups.
In …, the suspect file is moved and made non-executable without being deleted: it can be … if it is a false positive.
Show the answer
In quarantine, the suspect file is moved and made non-executable without being deleted: it can be restored if it is a false positive.
Deleting with no way back would be risky: a false positive on a system file or a business tool would do more harm than the threat.
Heuristic detection: what is it?
Show the answer
A method that judges a file from clues that it resembles malicious code, without recognising it exactly.
It spots unknown variants, but relies on similarity rules: it is wrong more often about legitimate programs.