Exam SY0-601 topic 1 question 650 discussion

Heuristic scanning (or analysis) Heuristic scanning does not rely on a virus dictionary. Instead, it looks for suspicious behavior—anything that does not fit into a “normal” pattern of behavior for the operating system (OS) and applications running on the system being protected. CompTIA Security+ All In One Exam Guide. C

B, i think it is obvious. question is asking to "protect". however, none of rest option can protect, they can only detect.

Given the scenario's emphasis on the malware evading detection and spreading through the network shares, the most appropriate option would be: C. Implement a heuristic behavior-detection solution. By implementing a solution that can detect suspicious behavior and activity, the security administrator can better identify and stop the malware's spread within the network, even if its signature is not known. This proactive approach can help mitigate the impact of the malware and prevent similar incidents in the future.

Heuristic behavior is already part of IDS/IPS. Plus the goal is to protect the environment, not just detect. We cannot assume what protective and detective controls were already in place before the virus spread.

C. Implement a heuristic behavior-detection solution. Both B and C are correct. There are IDS/IPS systems with heuristic Behavior detection capabilities.

Too late for everything else

Here is what Chatgpt has to say: B. Implement an IDS/IPS: An Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) are designed to detect and prevent suspicious or malicious network activity. They can identify anomalies and behavior that may indicate malware activity, even if the malware is new or previously unknown. Implementing an IDS/IPS can provide real-time monitoring and protection against threats like the one described. C. Implement a heuristic behavior-detection solution: Heuristic behavior detection solutions analyze the behavior of software or network traffic to identify anomalies or potential threats. While this approach can be effective, it may not be the best choice in this scenario, as it's already mentioned that protective measures have failed, and a more robust solution like an IDS/IPS is warranted.

Heuristic-based solutions are particularly good for situations where signature or definition-based ones are just not cutting it.

since the malware has evaded detection and spread to the network shares, it's important to consider more advanced security measures. While all of the options listed could play a role in enhancing security, the most suitable choice to protect the environment from this malware is:

I'm going D here, because the answer is always CASB. C, the suggested answer, does not seem right to me.