Attackers are targeting a browser vulnerability that uses memory corruption to inject code into the running browser process, without dropping a malicious file. Which Cisco Secure Endpoint engine is designed to protect against this technique?
Select an answer to reveal the explanation.
Short Explanation
If the attack never drops a file, a file scanner has nothing to look at. Exploit Prevention guards the process memory itself, so the injection gets stopped mid-move. You'll see TETRA and custom detections as tempting picks, but both need a file on disk.
Full Explanation
Exploit Prevention in Cisco Secure Endpoint protects processes such as browsers, document readers and office applications against memory-based attacks. It hardens the memory layout of protected processes so that injected code or exploit techniques that depend on predictable memory fail, and it blocks the attempt before the attacker's code can run. Because it does not depend on a file signature, it addresses exploits that inject code directly into a running process without writing a malicious executable. TETRA is the offline antivirus engine on Windows connectors; it inspects files against local signatures, so an attack that never writes a file gives it nothing to scan. Simple custom detections match the SHA-256 of files the organization wants treated as malicious; again, a memory-only attack has no file hash to match. Device Control governs access to removable media such as USB storage and has no role in protecting a browser process from code injection. Exam caveat: Exploit Prevention can run in audit or block mode, and legitimate software occasionally needs an executable exclusion, which should be narrow. Operational check: confirm that Exploit Prevention is enabled in block mode in the relevant policy, then review exploit prevention events to confirm that the browser is listed as a protected process.