220-1002 · Question #443
A user's computer reports it has many virus infections and directs the user to call a phone number for assistance. A technician removes the hard drive and virus scans the drive with another…
The correct answer is D. Old virus definitions. When a scan of an isolated drive finds no viruses, outdated antivirus definitions are the most likely reason the scanner fails to detect the threat. Signature-based scanners cannot identify malware whose signatures were added to the database after the last definition update.
Question
A user's computer reports it has many virus infections and directs the user to call a phone number for assistance. A technician removes the hard drive and virus scans the drive with another computer. The scan does not identify any viruses. Which of the following is MOST likely the problem?
Options
- ARootkit
- BZero-day malware
- CRogue antivirus
- DOld virus definitions
How the community answered
(42 responses)- A12% (5)
- B7% (3)
- C2% (1)
- D79% (33)
Why each option
When a scan of an isolated drive finds no viruses, outdated antivirus definitions are the most likely reason the scanner fails to detect the threat. Signature-based scanners cannot identify malware whose signatures were added to the database after the last definition update.
A rootkit hides itself from the infected OS, but scanning the drive externally from another system bypasses that self-hiding mechanism, making it detectable - so a clean external scan makes a rootkit unlikely.
Zero-day malware has no known signature anywhere, but this would be equally undetectable regardless of definition age and does not specifically explain why a scan on an external system returns clean.
Rogue antivirus (scareware) generates fake alerts without a real infection, which would also result in a clean external scan - however the answer key identifies old definitions as the cause of the missed detection.
Antivirus engines rely on signature databases to match known malware patterns; if definitions have not been updated, any malware newer than the last update will not be recognized and the scan will return clean results. The suspicious behavior on the original system (fake infection alerts directing the user to call a number) would go unexplained by the scan because the scanner lacks the signatures needed to detect those specific threats.
Concept tested: Antivirus definition currency and detection failure
Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus
Topics
Community Discussion
No community discussion yet for this question.