NOCTI Cybersecurity Standard Certification Practice Exam

Virus signatures are the exact patterns or fingerprints that security software uses to identify known malware. These signature files, downloaded as definitions, serve as a library of known threats. When the scanner examines files or processes, it looks for matches against this database; finding a match flags the item as malicious so it can be quarantined, removed, or blocked. This approach is fast and effective for recognizing known viruses because it relies on precise, pre-compiled patterns.

Other techniques exist to catch threats not yet cataloged. Heuristics detect suspicious code or behavior rather than exact patterns, which helps identify new variants but can produce more false positives. Sandboxing runs suspect code in a controlled environment to observe what it does before allowing it to run normally. Quarantine isolates files suspected of being malicious to prevent harm while a decision is made.