Detailed Explanations for Questions 181-200
Q181. Which type of malware is likely the most impactful?
- A. Worm
- B. Dropper
- C. Ransomware ✓
- D. Virus
Why C is correct: Ransomware is currently considered the most impactful type of malware due to its direct financial consequences. It encrypts critical data and demands payment for decryption, causing operational downtime, data loss, and significant financial costs (ransom payments + recovery costs + reputational damage).
Why others are incorrect:
- A: Worms can spread rapidly and cause network congestion, but they don’t typically demand direct payment or encrypt data for extortion like ransomware.
- B: A dropper is a delivery mechanism used to install other malware; its impact depends on the payload it delivers, not the dropper itself.
- D: Viruses require a host file and human interaction to spread; while damaging, their overall financial impact is generally lower than modern ransomware campaigns.
Q182. As an attacker, you successfully exploited your target using a service that should have been disabled. The service had vulnerabilities that you were able to exploit with ease. There appeared to be a large cache of readily accessible information. What may be the issue here?
- A. The administrator did not apply the correct patches.
- B. The web server was improperly configured.
- C. You are dealing with a honeypot. ✓
- D. The firewall was not configured correctly.
Why C is correct: A honeypot is a decoy system designed to attract attackers. It is often configured to look vulnerable (e.g., services that should be disabled are left open) and contains “bait” data (readily accessible information) to lure attackers in. If exploitation is too easy and valuable data is left unprotected, it is likely a trap to study attacker behavior.
Why others are incorrect:
- A: While unpatched systems are vulnerable, the combination of “should have been disabled” services plus “readily accessible information” suggests intentional baiting rather than simple negligence.
- B: Improper configuration might leave ports open, but it wouldn’t necessarily leave a large cache of valuable data easily accessible unless it was intentional bait.
- D: A misconfigured firewall might allow traffic, but it doesn’t explain the presence of exploitable services that should be disabled, plus bait data.
Q183. An application that is designed to look like a known legitimate application but is actually malicious in nature is considered what type of malware?
- A. Spyware
- B. Rootkit
- C. Adware
- D. Trojan ✓
Why D is correct: A Trojan (or Trojan Horse) is defined by its deception; it disguises itself as legitimate or useful software to trick users into executing it. Unlike viruses or worms, Trojans do not self-replicate but rely on social engineering.
Why others are incorrect:
- A: Spyware is designed to secretly monitor user activity and collect data, not necessarily by disguising itself as a specific legitimate application.
- B: Rootkits are designed to hide their existence and provide privileged access, often at the kernel level, rather than masquerading as a user application.
- C: Adware displays unwanted advertisements; while annoying, its primary purpose isn’t necessarily to disguise itself as a specific legitimate app to gain execution.
Q184. What is a major drawback of most antivirus software?
- A. It can be extremely slow.
- B. It must have the latest virus definitions. ✓
- C. It can take up a lot of host resources.
- D. It requires a lot of effort to administer.
Why B is correct: Most traditional antivirus software relies on signature-based detection. This means it can only identify malware that matches known signatures in its database. If the definitions aren’t updated, the software cannot detect new (zero-day) malware or variants released after the last update.
Why others are incorrect:
- A: Modern antivirus is optimized to minimize performance impact; slowness is not the primary drawback compared to detection limitations.
- C: While resource usage exists, modern solutions are lightweight; the detection gap is a more critical security drawback.
- D: Administration effort varies by deployment size, but isn’t an inherent technological drawback of the software itself.
Q185. A user reports that they have downloaded a music file from the Internet. They inform you that when they opened the file, it seemed as though it installed an application, and then the user was prompted to send a payment of $500 to a PayPal account to get the key to decrypt their hard drive. The user no longer has access to their desktop. What could be the issue?
- A. The user is experiencing a hoax.
- B. The user downloaded and installed ransomware. ✓
- C. The user installed malware.
- D. The user downloaded the wrong music file.
Why B is correct: The scenario describes the classic behavior of ransomware: malicious code executes (often disguised as another file), encrypts the user’s data (hard drive), and demands payment (ransom) in exchange for the decryption key to restore access.
Why others are incorrect:
- A: A hoax might display a scary message, but it typically doesn’t actually encrypt files or lock the system.
- C: While technically true (ransomware is malware), “Ransomware” is the specific and accurate classification for this behavior.
- D: The issue isn’t the file type itself but the malicious payload contained within or associated with it.
Q186. What technique would a malware author use to try to make it past an anti-malware solution?
- A. Disassembly
- B. Obfuscation ✓
- C. Reverse engineering
- D. Dropper
Why B is correct: Obfuscation involves altering the code’s appearance (e.g., encoding, encryption, inserting junk code) without changing its functionality. This changes the file’s signature, helping it evade signature-based antivirus detection.
Why others are incorrect:
- A: Disassembly is a technique used by analysts to understand malware code, not by authors to hide it.
- C: Reverse engineering is used by defenders to analyze malware, not by authors to evade detection.
- D: A dropper is a type of malware delivery mechanism, not a technique for evading detection itself (though droppers may use obfuscation).
Q187. Which of the following is an application that does not need a host or human interaction to disrupt and corrupt data?
- A. Worm ✓
- B. Virus
- C. Trojan
- D. Malware
Why A is correct: A worm is a standalone malware program that replicates itself to spread to other computers without needing a host file or human interaction (e.g., clicking a file). It exploits network vulnerabilities to propagate automatically.
Why others are incorrect:
- B: A virus requires a host file to attach to and typically requires human action (executing the host file) to spread.
- C: A Trojan requires a user to execute it, thinking it’s legitimate; it does not self-replicate.
- D: Malware is the umbrella term for all malicious software, not a specific type with these characteristics.
Q188. What type of virus can change or rewrite itself every time it infects a new file?
- A. Polymorphic virus
- B. Metamorphic virus ✓
- C. Trojan virus
- D. Shell virus
Why B is correct: A metamorphic virus rewrites its own code completely each time it infects a new file, changing its signature significantly while maintaining functionality. This makes detection by signature-based AV extremely difficult.
Why others are incorrect:
- A: A polymorphic virus encrypts its body and changes its decryption routine (signature) with each infection, but the underlying code remains the same; metamorphic viruses actually rewrite the code.
- C: Trojans do not typically self-replicate or rewrite themselves upon infection.
- D: A shell virus wraps itself around a host program but doesn’t necessarily rewrite its own code with every infection.
Q189. Which of the following malware achieved a historical first by causing physical damage to a nuclear reactor facility?
- A. Stuxnet ✓
- B. Blue’s Revenge
- C. ILOVEYOU virus
- D. BackOrifice
Why A is correct: Stuxnet is a famous worm discovered in 2010 that targeted SCADA systems (specifically Siemens PLCs) in Iran’s nuclear program. It caused centrifuges to spin out of control and physically destroy themselves, marking the first known cyberattack to cause physical destruction.
Why others are incorrect:
- B: “Blue’s Revenge” is not a recognized malware name associated with physical damage.
- C: ILOVEYOU was a widespread email worm that caused data loss and economic damage but no physical destruction.
- D: BackOrifice is a remote access Trojan (RAT) for system control, not known for causing physical damage to industrial equipment.
Q190. Due to the ILOVEYOU virus, Microsoft implemented a new business practice in its software to prevent such attacks from occurring again. What was it?
- A. Disabling the macro features in Microsoft Office by default ✓
- B. Disabling the CD-ROM autorun feature
- C. Setting user profiles to disabled
- D. Removing HEKY_LOCAL_MACHINE\USER
Why A is correct: The ILOVEYOU virus (2000) spread via email attachments that used VBScript macros in Microsoft Office. In response, Microsoft changed default settings to disable macros in Office documents to prevent automatic execution of malicious code.
Why others are incorrect:
- B: Autorun disabling was a response to later worms like Conficker that spread via USB drives, not specifically ILOVEYOU.
- C: User profiles were not disabled; this would break functionality.
- D: Registry keys were not removed; this would destabilize the OS.
Q191. Microsoft Office and other office suite applications have a feature that should be turned off to prevent malware from executing or spreading. What feature should be disabled?
- A. Mail
- B. FTP client
- C. Auto-update feature
- D. Macro feature ✓
Why D is correct: Macros are scripts that can automate tasks within Office documents. Malware authors often embed malicious macros in documents; when a user enables content, the code executes. Disabling macros by default prevents this attack vector.
Why others are incorrect:
- A: Mail functionality is essential for communication and isn’t the primary execution vector for document-based malware.
- B: FTP clients are less commonly used for malware execution compared to macros.
- C: Auto-update features are beneficial for security patching and should generally remain enabled.
Q192. Apache OpenOffice and Microsoft Office have a built-in feature that allows the user to automate a series of specified commands. These commands usually assist with daily routine tasks. This feature can be used in conjunction with launching malware. What feature is this?
- A. File sharing services
- B. Object Link
- C. Macro ✓
- D. Compression
Why C is correct: Macros are designed to automate repetitive tasks by recording or scripting a series of commands. However, this capability allows attackers to embed malicious scripts that execute when the document is opened.
Why others are incorrect:
- A: File-sharing services allow collaboration but don’t automate command execution within the document.
- B: Object Linking (OLE) embeds objects but isn’t primarily for automating command sequences.
- D: Compression reduces file size and doesn’t execute commands.
Q193. Software that creates pop-up advertisement messages while visiting websites is known as what?
- A. Adware ✓
- B. Malware
- C. Pop-up blocker
- D. Freeware
Why A is correct: Adware is specifically designed to display unwanted advertisements, often in the form of pop-ups, to generate revenue for the attacker. It may track browsing habits to target ads.
Why others are incorrect:
- B: Malware is the general term for malicious software; Adware is the specific type described.
- C: A pop-up blocker prevents ads; it doesn’t create them.
- D: Freeware is software available at no cost; it may contain adware, but it isn’t defined by creating pop-ups.
Q194. Which of the following is a good practice that includes the ability to isolate systems and detect attacks, and may also include preventive measures?
- A. Defense in depth
- B. Security measure
- C. Baseline configuration
- D. Defensible network architecture ✓
Why D is correct: A defensible network architecture is designed with security in mind, incorporating segmentation (isolation), monitoring (detection), and controls (prevention) to make it harder for attackers to move laterally and easier for defenders to detect them.
Why others are incorrect:
- A: Defense in depth is a strategy of layered security controls, but “Defensible network architecture” specifically refers to the network design aspect mentioned (isolation, detection).
- B: “Security measure” is too vague and generic.
- C: Baseline configuration refers to a standard security setup for systems, not the overall network architecture.
Q195. Which of these technologies would you use to remove malware in the network before it got to the endpoint?
- A. Antivirus
- B. Endpoint detection and response
- C. Stateful firewall
- D. Unified threat management device ✓
Why D is correct: A Unified Threat Management (UTM) device combines multiple security functions (firewall, IPS, antivirus, malware scanning) at the network perimeter. It can scan and block malware in transit before it reaches the endpoint.
Why others are incorrect:
- A: Antivirus runs on the endpoint, meaning the malware has already reached the device.
- B: EDR runs on the endpoint to detect and respond to threats after they arrive.
- C: A stateful firewall tracks connection states but typically doesn’t perform deep malware scanning like a UTM.
Q196. What tool could you safely use to perform dynamic analysis on a malware sample?
- A. strings
- B. Cuckoo Sandbox ✓
- C. Ollydbg
- D. Cutter
Why B is correct: Cuckoo Sandbox is an automated malware analysis system that runs samples in an isolated virtual environment. It monitors behavior (network, file, registry changes) safely without risking the host system.
Why others are incorrect:
- A:
stringsIt is a static analysis tool that extracts text from binaries; it doesn’t execute the malware. - C: Ollydbg is a debugger used for dynamic analysis, but requires manual interaction and isn’t an isolated sandbox environment by default.
- D: Cutter is a reverse engineering platform (GUI for Radare2), primarily for static analysis/debugging, not automated sandboxing.
Q197. Which type of software is considered a framework, a set of preinstalled tools, that aids in compromising and exploiting targeted systems?
- A. Cain & Abel
- B. Metasploit ✓
- C. Mutavault
- D. Ettercap
Why B is correct: Metasploit is a comprehensive penetration testing framework that provides a vast library of exploits, payloads, and auxiliary modules. It streamlines the process of validating vulnerabilities and compromising systems.
Why others are incorrect:
- A: Cain & Abel is a password recovery and sniffing tool, not a full exploitation framework.
- C: Mutavault is a malware repository/database, not an exploitation framework.
- D: Ettercap is a suite for man-in-the-middle attacks and sniffing, not a general exploitation framework.
Q198. What tool could you use to easily create an executable that could be deployed on a system to connect back to a command and control system?
- A. msfvenom ✓
- B. hping3
- C. ven0m0us
- D. OpenVAS
Why A is correct: msfvenom is a command-line payload generator in the Metasploit Framework. It combines payload creation and encoding to generate standalone executables (e.g., .exe, .apk) that connect back to a listener (C2).
Why others are incorrect:
- B: hping3 is a packet crafting and scanning tool, not a payload generator.
- C: “ven0m0us” is not a standard security tool.
- D: OpenVAS is a vulnerability scanner, not a payload generator.
Q199. A system is compromised and is able to spawn a connection back to the adversary. What do you call the system or infrastructure the adversary is using to connect back to?
- A. Command and control ✓
- B. Command processor
- C. Shellcode manager
- D. Command manager
Why A is correct: Command and Control (C2 or C&C) refers to the infrastructure (servers, domains) used by attackers to communicate with compromised systems, send commands, and exfiltrate data.
Why others are incorrect:
- B: “Command processor” usually refers to a system component (like cmd.exe), not the attacker’s infrastructure.
- C: “Shellcode manager” is not a standard term for C2 infrastructure.
- D: “Command manager” is not a standard term for C2 infrastructure.
Q200. Which of the following tools uses Metasploit to launch attacks like phishing campaigns?
- A. Setoolkit ✓
- B. Ettercap
- C. Mimikatz
- D. Netcat
Why A is correct: The Social Engineer Toolkit (SET or Setoolkit) is designed for social engineering attacks. It integrates with Metasploit to generate payloads for phishing campaigns, credential harvesting, and USB-based attacks.
Why others are incorrect:
- B: Ettercap is used for network sniffing and MITM attacks, not specifically for automating phishing campaigns with Metasploit.
- C: Mimikatz is used for extracting credentials from memory, not launching phishing campaigns.
- D: Netcat is a networking utility for reading/writing data across connections, not an automation tool for phishing.
Key Takeaways for Module 7: Malware Threats
- Malware Types: Understand the distinctions: Worms (self-replicating, no host), Viruses (need host), Trojans (disguised), Ransomware (encrypts for payment), Rootkits (hide existence), Adware (ads).
- Evasion Techniques: Malware authors use Obfuscation, Polymorphism (encrypts code), and Metamorphism (rewrites code) to evade signature-based detection.
- Specific Malware: Know famous examples like Stuxnet (physical damage/SCADA), ILOVEYOU (email/macros), and WannaCry (ransomware/EternalBlue).
- Tools:
- Metasploit/msfvenom: Exploitation and payload generation.
- SET (Setoolkit): Social engineering automation.
- Cuckoo Sandbox: Safe dynamic analysis.
- UTM: Network-level malware scanning.
- Defense: Antivirus relies on definitions; sandboxing allows safe execution; disabling Macros prevents document-based attacks.
- Architecture: Defensible network architecture and Defense in Depth are key strategies for isolation and detection.
- C2: Compromised systems connect back to Command and Control infrastructure.
