SSCP Malicious Code Countermeasures Questions and Answers

Question 1

An organization is highly concerned about zero-day exploits and polymorphic malware that traditional antivirus solutions frequently miss.
They need a countermeasure that can analyze the behavior of an unknown executable in a safe, isolated environment before it is allowed to run on production endpoints.
Which of the following is the BEST solution?

Accepted Answer

Sandboxing

Answer

Stateful firewall inspection

Answer

Application blacklisting

Answer

Digital signature verification

Question 2

A security administrator implements a 'default-deny' policy for all software on company workstations. Only applications that are explicitly on an approved list are permitted to be installed or executed, and all others are blocked. Which malicious code countermeasure does this describe?

Accepted Answer

Application whitelisting

Answer

Heuristic analysis

Answer

Application blacklisting

Answer

Host-based Intrusion Prevention System (HIPS)

Question 3

Which of the following malicious code detection methods relies on a constantly updated database of known malware file hashes and patterns to identify threats?

Accepted Answer

Signature-based detection

Answer

Heuristic-based detection

Answer

Behavior-based detection

Answer

Anomaly-based detection

Question 4

A security operations center (SOC) analyst is investigating a security alert on a user's laptop. A traditional antivirus scan found nothing, but a more advanced tool provided a detailed timeline of a suspicious process that spawned other processes, modified registry keys, and initiated a network connection to an unknown external IP address. What type of tool MOST likely provided this detailed behavioral information?

Accepted Answer

Endpoint Detection and Response (EDR)

Answer

Network Intrusion Detection System (NIDS)

Answer

A signature-based antivirus scanner

Answer

A web application firewall (WAF)

Question 5

An analyst is configuring a Host-based Intrusion Detection System (HIDS) to identify potential malware. The system is first put into a learning mode to build a profile of normal CPU usage, file access patterns, and network traffic for a critical server. Once the profile is built, the system will alert on any significant deviations. Which detection method is being implemented?

Accepted Answer

Anomaly-based detection

Answer

Application whitelisting

Answer

Signature-based detection

Answer

Static code analysis

Question 6

An employee receives a phishing email containing a malicious macro-enabled document. Which combination of countermeasures would be MOST effective at preventing this specific threat vector at different stages?

Accepted Answer

Email gateway filtering and disabling macros via group policy

Answer

Full disk encryption and a host-based firewall

Answer

Network segmentation and two-factor authentication

Answer

Application whitelisting and a VPN