What technique does EPP use to identify malware?

• A. Signature File Updates
• B. Telemetry Events
• C. Signature File Detection
• D. Continuous Real-Time Monitoring

Answer: (C)

Signature-based detection uses a database of known malware signatures—unique byte patterns or file hashes that identify threats. The endpoint scans files, executables, and processes and compares them to this database. If a match is found, the item is flagged as malicious and actions like blocking or quarantine are taken. Keeping the signature database current is essential because detection relies on having the latest known patterns. Telemetry events are data collected from endpoints that can reveal suspicious activity, and continuous real-time monitoring describes the ongoing observation of behavior; both help speed detection but the actual identification of malware comes from matching against the signature database. Signature file updates matter for staying current, but they provide new patterns rather than performing detection itself.