A signature-based antivirus system will not detect which type of threat?

• A. Zero-day attacks
• B. Trojans
• C. Conficker
• D. Spyware

Answer: (A)

Signature-based antivirus relies on known patterns from a database of malware signatures. It detects threats by matching files or code to those existing signatures. This makes it strong against threats that defenders have already analyzed and signed off on. But it cannot reliably detect new, unseen threats because there is no signature to compare against yet. A zero-day attack is exactly that kind of unknown exploit, with no known signature at the time it first appears, so it can slip past a system that depends solely on signatures. Other listed threats—Trojans, spyware, and known worms like Conficker—are typically detectable when their signatures are included in up-to-date definitions, since they’ve already been identified and cataloged. Hence, the best answer is that a zero-day attack will not be detected by a signature-based antivirus.