1. A method for emulating at least one resource in a host computer to a querying hosted code, comprising: managing a general response policy defining a plurality of local response policies each for another of a plurality of monitored computing units including a monitored computing unit; monitoring a plurality of operating system (OS) queries received from a plurality of code executed on said monitored computing unit, said plurality of OS queries are designated to an OS of said monitored computing unit; detecting among said plurality of OS queries at least one query for receiving at least one characteristic of at least one resource of said monitored computing unit among said plurality of OS queries, said at least one query is received from querying code of said plurality of code; in response to said detecting at least one query, managing said general response policy by dynamically correlating between at least some of said plurality of local response policies at run time, wherein said local response policy for each one of a plurality of monitored computing units is correlated based on said general response policy; preparing a response of said OS to said at least one query according to response instructions defined in a respective said local response policy, said response comprising a false indication at least one false characteristic of said at least one resource; and sending said response to said querying code in response to said at least one query.