Sec+ Review

A group of compromised computers that have software installed by a

worm or Trojan is known as which of the following?

• Botnet

• Rootkit

• Virus

• Zombie

Answer explanation

A botnet is a group of compromised computers, usually working

together, with malware that was installed by a worm or a Trojan horse. An

individual computer within a botnet is referred to as a zombie (among

other things). A virus is code that can infect a computer’s files. A rootkit

is a type of software designed to gain administrator-level access to a

system.

Which of the following computer security threats can be updated

automatically and remotely?

• Virus

• Worm

• Zombie

• Malware

Answer explanation

Zombies (also known as zombie computers) are systems that have

been compromised without the knowledge of the owner. A prerequisite is

the computer must be connected to the Internet so that the hacker or

malicious attack can make its way to the computer and be controlled

remotely. Multiple zombies working in concert often form a botnet.

You have been given the task of scanning for viruses on a PC. What is the

best of the following methods?

• Recovery environment

• Command Prompt only

• Dual-boot into Linux

• Boot into Windows normally

Answer explanation

You should use a recovery environment. Most often, this would be the

one built into Windows. Many manufacturers suggest using this, and more

specifically Safe Mode. However, it could also be a Linux rescue disc or

flash drive. That’s not a true dual-boot though. An actual dual-boot is

when Windows and Linux are both installed to the hard drive. Command

Prompt only is not enough, nor is it necessary for some virus scanning

scenarios. Booting into Windows normally is tantamount to doing

nothing. Remember to use a recovery environment when scanning for

viruses.

Which of the following is a common symptom of spyware?

• Infected files

• Applications freeze

• Computer shuts down

• Pop-up windows

Answer explanation

Pop-up windows are common to spyware. The rest of the answers are

more common symptoms of viruses.

Dan is a network administrator. One day he notices that his DHCP server

is flooded with information. He analyzes it and finds that the information

is coming from more than 50 computers on the network. Which of the

following is the most likely reason?

• Virus

• Zombie

• Worm

• PHP Script

Answer explanation

A worm is most likely the reason that the server is being bombarded

with information by the clients; perhaps it is perpetuated by a botnet.

Because worms self-replicate, the damage can quickly become critical.

Which of the following is not an example of malicious software?

• Rootkits

• Viruses

• Spyware

• Browser

Answer explanation

A web browser (for example, Internet Explorer) is the only one listed

that is not an example of malicious software. Although a browser can be

compromised in a variety of ways by malicious software, the application

itself is not the malware.

Which type of attack uses more than one computer?

• Virus

• Worm

• DoS

• DDos

Answer explanation

A DDoS, or distributed denial-of-service, attack uses multiple

computers to make its attack, usually perpetuated on a server. None of the

other answers use multiple computers.

What is a malicious attack that executes at the same time every week?

• Virus

• Ransomware

• Worm

• Logic Bomb

Answer explanation

A logic bomb is a malicious attack that executes at a specific time.

Viruses normally execute when a user inadvertently runs them. Worms can self-

replicate at will. Ransomware is a type of malware that restricts access to

files (or entire systems) and demands a ransom be paid.

Which of these is a true statement concerning active interception?

• Computer is put between a sender and receiver

• Person overhears a conversation

• Person looks through files

• When a person hardens an operating system

Answer explanation

Active interception normally includes a computer placed between the

sender and the receiver to capture information. All other statements

concerning active interception are false. If a person overhears a

conversation it can be considered eavesdropping. When a person looks

through files it could be normal or malicious. When a person hardens an

operating system, that person is making it more secure. We discuss these

concepts as we progress through the book.

Which of the following types of scanners can locate a rootkit on a

computer?

• Image Scanner

• Barcode Scanner

• Malware Scanner

• Adware Scanner

Answer explanation

Malware scanners can locate rootkits and other types of malware.

These types of scanners are often found in anti-malware software from

manufacturers such as McAfee, Symantec, and so on. Adware scanners

(often free) can scan for only adware. Always have some kind of anti-

malware software running on live client computers!