A signature for detection is effectively constructed using:

Question

Options

• AThe attacker's IP address range
• BSpecific malware hash values
• CUnique malware behavior patterns
• DThe physical location of the attack origin

• A
  6% (1)
• C
  94% (17)

Explanation

Unique malware behavior patterns (C) form the foundation of effective detection signatures because behaviors - such as specific API call sequences, network communication patterns, or file system modifications - remain consistent across variants of the same malware family, even when attackers change hashes or IP addresses to evade detection.

Why the distractors fail:

• A (IP address range): Attackers trivially rotate IPs, use proxies, or leverage botnets, making IP-based signatures brittle and easily bypassed.
• B (Hash values): A single bit change to a file produces a completely different hash; polymorphic and metamorphic malware exploits this, rendering hash-based detection ineffective against variants.
• D (Physical location): Attack origin geolocation is imprecise, easily spoofed via VPNs/Tor, and provides no technical fingerprint of the malware itself.

Memory tip: Think of behavior as a criminal's MO - a burglar may change disguises (hash) or locations (IP), but their methods (behavior) stay recognizable. Detection that targets the how rather than the who or what file is far more durable.

No community discussion yet for this question.