At a retailer, a file on a register matches a known-bad hash, and the security product quarantines the file before it runs. Which technology performed that action?
Select an answer to reveal the explanation.
Short Explanation
A mug shot only helps when the face is already on file. You matched a known-bad hash and quarantined the register file before it ran, which is signature antivirus. The trap is a hashless behavior score, a port filter, or the store's mail gateway.
Full Explanation
Antivirus or antimalware that matched a known-bad hash and quarantined the file before it ran is the technology that did the work. Signature antivirus and antimalware keep known-bad hashes and compare files to that list. The register file matched a known-bad hash, and the product quarantined it before the file could run. That is a hash match followed by a block on execution, which is signature detection on the endpoint. A predictive model that scored rare behavior on the register and had no known-bad hash scores behavior that looks rare and does that scoring without a known-bad hash. This event had a hash match, so a hashless behavior score is not what fired. A host firewall that allows or denies ports and does not itself inspect file hashes on the register allows or denies ports on the host. It does not compute a file hash or quarantine a file, and the action in the scenario was taken on a file, not on a port. A mail gateway at the store edge that filters messages before they ever reach a register filters mail at the edge of the store, before a message reaches a register. The file was already on the register, and the action was a quarantine of that file, not a mail verdict. Exam caveat: a known-bad hash quarantine is signature detection. A model that has no hash is a different detector and can flag software that is allowed. Operational check: on the register, confirm the event cites the known-bad hash and that the file was quarantined before it executed.