What are two limitations of signature-based anti-malware software? (Choose two.)

Signature-based anti-malware operates by comparing files against a database of known malicious signatures. This method has two inherent limitations. First, it relies on a static database of previously identified threats (a static file), making it ineffective against new, or "zero-day," malware for which no signature exists. Second, this reliance on fixed signatures makes it unable to detect polymorphic malware, which is designed to constantly alter its code and, therefore, its signature with each new infection, thus evading detection by this static comparison method.

B. It requires samples to be buffered: Buffering is a common data handling technique and not a fundamental limitation of signature-based detection itself. Behavioral analysis or sandboxing is more likely to hold samples for extended observation.
D. It only uses packet header information: This is incorrect. Signature-based anti-malware must inspect the actual content of files and packet payloads to match them against its database of malicious signatures, not just the header data.

1. Palo Alto Networks, Threat Prevention Deployment Tech Note, Document Version 20220203. In the "Antivirus" section, it is explained that the PAN-OS antivirus engine uses a "database of signatures to detect and prevent malware." This confirms its reliance on a static set of known threats (Option C). The document later highlights the role of WildFire in analyzing unknown files, underscoring the limitation of signature-only approaches.

2. University of California, Berkeley, CS 161 Computer Security, Fall 2020, Lecture 18: Malware. Slide 11, "Signature-based Detection," explicitly lists the weaknesses of this approach as: "Fails against new malware (zero-day exploits)" and "Fails against polymorphic/metamorphic malware." This directly supports both correct answers (A and C).

3. Palo Alto Networks, WildFire Administrator's Guide PAN-OS 10.2. In the "WildFire Overview" section, the document states, "Traditional security approaches, such as...antivirus (AV) that relies on signatures, are not enough to stop them [advanced threats]." This establishes that signature-based methods have significant limitations that advanced solutions like WildFire (which uses dynamic analysis) are designed to overcome.