Exam 312-50v11 topic 1 question 95 discussion

The correct answer is Cloud-based. Cloud-based detection identifies malware by collecting data from protected computers while analyzing it on the provider's infrastructure, instead of performing the analysis locally. https://zeltser.com/how-antivirus-software-works/

Cloud Based, antivirus software leverages the power of cloud computing and centralized analysis to identify malware. Instead of analyzing files locally on individual systems, the files are sent to the provider's cloud environment for analysis.

The option correct is D: Cloud-based

Answer: D Cloud-based detection techniques in antivirus software involve collecting data from multiple protected systems and analyzing it in the provider's environment instead of locally on individual systems. This approach enables rapid response to new malware threats and reduces the computational overhead on local machines. By leveraging the power of cloud infrastructure, antivirus providers can analyze large volumes of data and deploy updates to their users more efficiently.

it's D

Cloud-based, it is done in cloud, not on-premise

D. Cloud base .

The actual analysis is performed in the provider's cloud.

C. The actual analysis is performed in the provider's cloud.

Correct

If you google, a lot of the information points to Cloud-based.

Cisco as a solution for this DNA cloud-based data platform where Machine Learning models are built and analyzed for your specific network environment.

It sound like a xRD to me, so i will say A.

hm. poor question...IDPS is all a blur nowadays..AI + ML yadda so I wouldn't get hung up on heuristics etc. best guess the only clear part of this question as I read it is WHERE is the analysis taking place? = the vendors (provider environment) like say PaloAlto etc. (which might have been exotic when this question was written)

SO what is the answer now A or D

A tcptrace is a free and open-source tool for analyzing TCP dump files.[1][2][3] It accepts as input files produced by packet-capture programs, including tcpdump, Wireshark, and snoop. tcptrace can produce several different types of output containing information on each connection seen, such as elapsed time, bytes and segments sent and received, retransmissions, round trip times, window advertisements, and throughput. It can also produce graphs for further analysis. As of version 5, minimal UDP processing has been implemented in addition to the TCP capabilities. https://en.wikipedia.org/wiki/Tcptrace

what makes this correct? do you have any basis? why not Hueristic since that detection is smart enough to think.