(ISC)2 Certified in Cybersecurity Practice Exam

What technique analyzes system behavior to detect deviations indicative of malware presence?

1. Signature detection

2. Anomaly detection

3. Full disk encryption

4. Session management

The correct answer is: Anomaly detection

Anomaly detection is a technique that examines the behavior of a system, looking for patterns that deviate from the established norms or baseline expected behaviors. This approach is particularly useful for identifying potential threats, such as malware, which may not be captured by traditional methods that rely on known signatures or patterns. By monitoring system activities, anomaly detection can flag unusual behaviors that might indicate an infection, such as abnormal file access patterns, unexpected network traffic, or unusual process activity. These deviations serve as indicators of malicious activity, allowing security professionals to respond proactively before more significant harm can occur. In contrast, signature detection relies on predefined patterns to identify known malware strains, making it less effective against new or unknown threats that do not match existing signatures. Full disk encryption and session management serve entirely different purposes related to data protection and user sessions, thus not applicable to the context of detecting malware through behavioral analysis.