Palo Alto Networks (PANW) Certified Cybersecurity Entry-level Technician (PCCET) Practice Exam

Which type of malware protection is vulnerable to a low and slow approach?

1. Signature-based

2. Container-based

3. Application allow lists

4. Anomaly detection

The correct answer is: Anomaly detection

The "low and slow" approach refers to a tactic used by attackers to evade detection by implementing their activities gradually over time instead of launching a sudden, high-volume attack. Anomaly detection systems are designed to identify unusual patterns of behavior that deviate from established baselines. However, if an attacker adopts a low and slow method, their actions may not create significant deviations from normal activity during any single time period. As a result, these subtle changes can go undetected by anomaly detection systems which rely on identifying significant anomalies for alerting. Signature-based detection, on the other hand, relies on known patterns of malware. Since low and slow tactics might avoid triggering established signatures, they wouldn't be specifically vulnerable in the same way anomaly detection systems are. Container-based and application allow list protections function differently and focus on preventing unrecognized applications or code from executing, which would not inherently exhibit the same vulnerabilities to the low and slow strategy. Therefore, in the context of this attack strategy, anomaly detection is the most susceptible to being bypassed by attackers utilizing a low and slow approach.