SECFND 12: Endpoint Security Technologies

Question 1

Address on whitelist and blacklist. Which wins?

Answer 1

Whitelist

Question 2

Whitelisted/blacklisted apps can be identified by…

Answer 2

hash value, certificate

Question 3

Whitelisting flaw

Answer 3

Apps that run in memory

Question 4

AV File trajectory

Answer 4

Hosts where files were seen

Question 5

AV Device trajectory

Answer 5

Actions that files performed on a given host

Question 6

Packed malware

Answer 6

Compressed to make it polymorphic