At a manufacturer, a record says a file hash was detected and the matching file was quarantined on a workstation. Which technology produced that record?
Select an answer to reveal the explanation.
Short Explanation
Locking a known-bad file in a drawer is an action on the computer that holds the file. You have a hash detection and a quarantine on the workstation, so the source is antivirus. The trap is a firewall decision, a proxy log, or a flow summary.
Full Explanation
Antivirus on the workstation that detected a file hash and quarantined that file locally produced the record. Antivirus on the workstation compares a file with a known hash and can quarantine that file on the same computer. The manufacturer record says a file hash was detected and the file was quarantined on a workstation. Both the hash and the quarantine are endpoint actions, so the source is the workstation antivirus. A firewall record that permitted or denied the flow using addresses, ports, and protocol only permits or denies a flow using addresses, ports, and protocol. A firewall record does not detect a file hash and does not quarantine a file on a workstation. A proxy log that names the user, the full URL, a web category, and a block or an allow names a user, a full URL, a category, and a block or allow. A proxy does not quarantine a file by hash on the workstation, and this record does not cite a URL. A NetFlow record of the source, the destination, the ports, the packet counts, and the byte counts lists source, destination, ports, packet counts, and byte counts. Flow telemetry has no file hash and no quarantine action. It cannot show that a file was locked because of a hash. Exam caveat: a firewall can drop a transfer, but a record that cites a file hash and a quarantine on the workstation is the endpoint product, not the firewall. Operational check: on the workstation, confirm the file is quarantined and that the event cites the hash.