A ransomware variant with no known file disposition starts encrypting user documents rapidly, launched by malicious scripts through built-in system tools. Which Cisco Secure Endpoint protections address this activity rather than relying on file reputation?
Select an answer to reveal the explanation.
Short Explanation
When the attacker brings a brand-new key, you can't rely on a list of known bad keys; you watch for someone rattling every door at once. MAP and Behavioral Protection watch what processes do, like suddenly encrypting files in bulk. Trajectories are great for the story afterward, but they don't stop anything.
Full Explanation
Malicious Activity Protection monitors processes for behavior typical of ransomware, such as rapid encryption or modification of many user files, and can stop or quarantine the offending process. Behavioral Protection evaluates sequences of runtime activity, including script and command-line behavior through built-in tools, against behavioral signatures that Cisco updates. Both act on what processes do, so they can stop a variant with no known file disposition and an attack that abuses legitimate system tools. Simple custom detections and application blocking lists both depend on known SHA-256 hashes; a new ransomware build or a script run through a trusted interpreter offers no matching hash. Exclusions and audit mode reduce protection; using them to avoid slowing encryption would let the ransomware finish its work. File trajectory and device trajectory are investigation views that record and display activity; they do not block anything. Exam caveat: behavioral engines can produce false positives on legitimate bulk-encryption or backup software, so tune with narrow exclusions rather than disabling the engine. Operational check: confirm that Malicious Activity Protection and Behavioral Protection are enabled in protect or block modes in the relevant policies, and review their events to confirm detections are being generated and acted on.