nerdexam
Cisco

700-281 · Question #61

Which of these is a drawback in using McAfee heuristic scanning?

The correct answer is C. heuristic scanning increases the probability of false positives. Heuristic scanning analyzes code behavior and structure to detect suspicious patterns rather than matching known signatures - and because it's making educated guesses, it flags legitimate programs as threats more often than signature-based scanning does, making false positives…

Describe Cisco Web Security Solutions

Question

Which of these is a drawback in using McAfee heuristic scanning?

Options

  • Aheuristic scanning cannot detect new malware with an unknown signature
  • Bheuristic scanning requires a separate license key
  • Cheuristic scanning increases the probability of false positives
  • Dheuristic scanning increases the probability of false negatives

How the community answered

(30 responses)
  • A
    7% (2)
  • C
    90% (27)
  • D
    3% (1)

Explanation

Heuristic scanning analyzes code behavior and structure to detect suspicious patterns rather than matching known signatures - and because it's making educated guesses, it flags legitimate programs as threats more often than signature-based scanning does, making false positives the primary drawback (C).

Why the distractors are wrong:

  • A is backwards - detecting new malware without known signatures is actually heuristics' main advantage over traditional signature scanning.
  • B is fabricated - no such separate license requirement exists for heuristic scanning as a feature.
  • D is the opposite of reality - heuristics casts a wider net, so it produces more false positives (incorrectly flagging safe files), not more false negatives (missing real threats).

Memory tip: Think of heuristics as a "suspicious by association" approach - it errs on the side of caution, so it over-flags. More caution = more false alarms = more false positives.

Topics

#Heuristic Scanning#False Positives#Threat Detection#McAfee

Community Discussion

No community discussion yet for this question.

Full 700-281 Practice