ITPEC IP April 2024 Question 42

Behavioral detection monitors program activity and stops behavior that appears malicious, even without a known signature. Suspicious actions can include unexpected external communication, mass file modification, privilege escalation, code injection, or unusual process relationships. Because detection focuses on what software does, it can identify some previously unknown malware and zero-day exploitation.

Answer (c)

Why not others:
- (a) describes a screen saver or idle-display function
- (b) describes account lockout after repeated authentication failures
- (d) describes input validation or sanitization used to neutralize harmful web input

Key rule: Signature detection matches known patterns; behavioral detection looks for suspicious actions and therefore can respond to threats whose exact code has not been seen before.

AI-generated — may contain errors