Question

Which of the following techniques might be used to automatically detect and block malicious software that does not match known malware signatures?

A. MAC
B. Hashing
C. Decompiling
D. Sandboxing

Answer 1

Sandboxing is a technique used to detect and block malicious software that does not match known malware signatures by monitoring program behavior in an isolated environment.

Step-by-step explanation:

To automatically detect and block malicious software that does not match known malware signatures, the technique that might be used is D. Sandboxing. Sandboxing involves running a program in an isolated environment to monitor its behavior without risking the system's security. Unlike signature-based detection, which relies on known patterns, sandboxing allows analysts to observe the behavior of potentially harmful software and block it if it acts in a suspicious manner, such as attempting to modify system files or install unauthorized software.

Techniques like MAC (Mandatory Access Control), Hashing, and Decompiling serve different purposes. MAC enforces security policies at a system level, Hashing allows integrity checking, and Decompiling translates binary code back into readable source code, none of which are primarily used for dynamic malware analysis and protection like sandboxing.

Answer 2

To automatically detect and block malicious software that doesn't match known malware signatures, the technique commonly employed is Sandboxing.

Therefore, correct answer is D. Sandboxing

Step-by-step explanation:

Traditional antivirus solutions rely on known malware signatures, but they struggle to identify new, previously unseen threats. Sandboxing, on the other hand, is a proactive approach to threat detection. It involves executing potentially malicious code in a controlled environment (the "sandbox") to observe its behavior without risking harm to the actual system.

By isolating and analyzing the behavior of the software in a sandbox, security systems can detect suspicious activities indicative of malware, even if the specific signatures are unknown. This proactive method is effective against zero-day attacks and new, sophisticated threats that may not have identifiable signatures.

Therefore, correct answer is D. Sandboxing