Which AMP feature is provided by fuzzy fingerprinting?

Question

Options

• AIdentifies specific instances of malware with a signature-based approach
• BAutomatically detects polymorphic variants of known malware
• CProvides recursive DNS lookup services
• DIdentifies new malware using statistical modeling and analytics engines

• A
  4% (1)
• B
  88% (22)
• D
  8% (2)

Explanation

Fuzzy fingerprinting in Cisco AMP is designed to detect polymorphic malware - variants of known threats that have been slightly altered (e.g., repackaged or obfuscated) to evade traditional detection. By using approximate matching rather than exact hash matching, fuzzy fingerprinting catches these mutated variants even when their binary signatures differ from the original, making B correct.

• A is wrong because exact signature matching (like MD5 hashes) is what identifies specific known malware instances - that's traditional antivirus behavior, not fuzzy fingerprinting.
• C is wrong because recursive DNS lookups are a networking/DNS service function, completely unrelated to malware analysis.
• D is wrong because statistical modeling and analytics engines describe machine learning / behavioral analytics features in AMP (like Spero or Ethos engines), not fuzzy fingerprinting specifically.

Memory tip: Think of "fuzzy" as close but not exact - fuzzy fingerprinting finds malware that looks similar to known threats, which is exactly what polymorphic variants are: tweaked copies of existing malware.

No community discussion yet for this question.