nerdexam
GIAC

GPEN · Question #279

Which of the following tasks is NOT performed by antiviruses?

The correct answer is D. Session hijacking. Antivirus software is a defensive tool for detecting and removing malware; session hijacking is an offensive network attack technique entirely outside its scope.

Penetration Testing Foundations & Reconnaissance

Question

Which of the following tasks is NOT performed by antiviruses?

Options

  • AActivity blocking
  • BHeuristic scanning
  • CIntegrity scanning
  • DSession hijacking

How the community answered

(49 responses)
  • A
    2% (1)
  • B
    6% (3)
  • C
    12% (6)
  • D
    80% (39)

Why each option

Antivirus software is a defensive tool for detecting and removing malware; session hijacking is an offensive network attack technique entirely outside its scope.

AActivity blocking

Activity blocking is a standard antivirus capability that prevents suspicious or malicious processes from executing on the host based on behavioral rules.

BHeuristic scanning

Heuristic scanning is a core antivirus technique used to detect unknown or zero-day malware by analyzing code behavior and structure rather than relying solely on known signatures.

CIntegrity scanning

Integrity scanning is performed by antivirus software to detect unauthorized file modifications by comparing current file hashes or attributes against a trusted baseline.

DSession hijackingCorrect

Session hijacking is an offensive attack technique in which an adversary takes control of an authenticated network session belonging to another user, which antivirus software is not designed to perform. Antivirus tools are limited to defensive functions such as detecting, quarantining, and removing malicious code - not executing network-layer attacks.

Concept tested: Antivirus software capabilities versus offensive attack techniques

Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/next-generation-protection

Topics

#antivirus capabilities#session hijacking#heuristic scanning#security tool scope

Community Discussion

No community discussion yet for this question.

Full GPEN Practice