Which capability allows an attacker to bypass firewall, antivirus, IDS/IPS, and email spam filter?

• A. Bypassing Perimeter Defenses
• B. Evading Signature-Based Detection Systems
• C. Exploiting Zero-Day Vulnerabilities
• D. Social Engineering Attacks

Answer: (B)

The capability being tested is evading signature-based detection systems. These defenses rely on known patterns, fingerprints, or signatures to identify threats: malware binaries, payloads, URLs, or network traffic that match a catalog of known bad items. When an attacker changes the payload so it no longer matches those signatures—through obfuscation, encryption, packing, or polymorphic/metamorphic techniques—the tools fail to recognize it as malicious. Because firewall rules, antivirus scans, IDS/IPS signatures, and email spam filters are built around detecting known signatures, bypassing this approach lets the attacker slip through multiple layers of protection.

While zero-day exploits and social engineering are also tools in an attacker’s kit, they don’t inherently address defeating signature-based detection across all these defenses in the same direct way. A zero-day targets an unseen vulnerability, and social engineering targets human behavior, whereas evading signature-based detection specifically undermines the automatic pattern-metection mechanism that many defenses rely on.