A security analyst is investigating an alert that was produced by endpoint protection software. The analyst determines this event was a false positive triggered by an employee who attempted to…

Question

Options

• AA misconfiguration in the endpoint protection software
• BA zero-day vulnerability in the file
• CA supply chain attack on the endpoint protection vendor
• DIncorrect file permissions

• A
  70% (19)
• B
  11% (3)
• C
  15% (4)
• D
  4% (1)

Explanation

The most likely reason the download was blocked, resulting in a false positive, is a misconfiguration in the endpoint protection software. False positives occur when legitimate actions are incorrectly identified as threats due to incorrect settings or overly aggressive rules in the security software. Misconfiguration in the endpoint protection software: Common cause of false positives, where legitimate activities are flagged incorrectly due to improper settings. Zero-day vulnerability: Refers to previously unknown vulnerabilities, which are less likely to be associated with a false positive. Supply chain attack: Involves compromising the software supply chain, which is a broader and more severe issue than a simple download being blocked. Incorrect file permissions: Would prevent access to files but not typically cause an alert in endpoint protection software.

No community discussion yet for this question.