What is a limiting factor of detection tools for malware behavior?

Question

Options

• AHigh false positive rates
• BInability to decrypt traffic
• CLack of skilled personnel
• DAll of the above

• A
  4% (1)
• B
  4% (1)
• C
  11% (3)
• D
  82% (23)

Explanation

Option D is correct because all three options represent real, documented limitations of malware behavior detection tools - they are not mutually exclusive. High false positive rates (A) cause alert fatigue, leading analysts to miss genuine threats or disable tools altogether. The inability to decrypt traffic (B) is a fundamental technical constraint: many detection tools cannot inspect encrypted channels like TLS without a proxy, allowing malware to hide command-and-control communications. Lack of skilled personnel (C) is an organizational limitation that compounds both prior issues - even effective tools fail without trained analysts to tune, interpret, and respond to them.

Memory tip: Think of the three pillars a detection program needs - accuracy (A), visibility (B), and people (C). If any pillar is missing, the program fails. "All of the above" answers on security exams often signal that a problem is multi-dimensional rather than having a single root cause.

No community discussion yet for this question.