700-765 · Question #30
Which AMP feature is provided by fuzzy fingerprinting?
The correct answer is B. Automatically detects polymorphic variants of known malware. Fuzzy fingerprinting in Cisco AMP detects polymorphic malware variants by generating flexible hashes that tolerate small changes in malware code.
Question
Which AMP feature is provided by fuzzy fingerprinting?
Options
- AIdentifies specific instances of malware with a signature-based approach
- BAutomatically detects polymorphic variants of known malware
- CProvides recursive DNS lookup services
- DIdentifies new malware using statistical modeling and analytics engines
How the community answered
(27 responses)- B89% (24)
- C4% (1)
- D7% (2)
Why each option
Fuzzy fingerprinting in Cisco AMP detects polymorphic malware variants by generating flexible hashes that tolerate small changes in malware code.
Exact signature-based detection uses fixed byte-pattern hashes (like MD5/SHA256), which is a separate mechanism from fuzzy fingerprinting.
Fuzzy fingerprinting creates approximate hashes (using techniques like fuzzy hashing or SSDEEP) that remain similar even when a malware binary is slightly modified, enabling detection of polymorphic variants that evade exact signature matches. This allows AMP to identify a family of related malware samples without needing a unique signature for every mutation. It fills the gap between rigid signature detection and fully behavioral analysis.
Recursive DNS lookup is a DNS resolution function unrelated to malware fingerprinting or AMP features.
Statistical modeling and analytics engines describe Cisco's machine learning and behavioral analytics capabilities in AMP, not fuzzy fingerprinting specifically.
Concept tested: AMP fuzzy fingerprinting for polymorphic malware detection
Source: https://docs.cisco.com/en/cisco-secure-endpoint/api/v3/index.html
Topics
Community Discussion
No community discussion yet for this question.