Chapter 3

What occurs on a computer when data goes beyond the limits of a buffer?

• a system exception

• cross-site scripting

• an SQL injection

• a buffer overflow

Answer explanation

Refer to Chapter 3 - Slides 50 - Application Attacks
A buffer overflow occurs when data goes beyond the limits of a buffer. Buffers are memory areas allocated to an application. By changing data beyond the boundaries of a buffer, the application accesses memory allocated to other processes. This can lead to a system crash, data compromise, or provide escalation of privileges.

What does a rootkit modify?

• programs

• Microsoft Word

• operating system

• Use antivirus software

Answer explanation

Refer to Chapter 3 - Slides 12 - Type of Malware
A rootkit modifies the operating system to create a backdoor. Attackers then use the backdoor to access the computer remotely. Most rootkits take advantage of software vulnerabilities to perform privilege escalation and modify system files. Privilege escalation takes advantage of programming errors or design flaws to grant the criminal elevated access to network resources and data. It is also common for rootkits to modify system forensics and monitoring tools, making them very hard to detect. Often, a user must wipe and reinstall the operating system of a computer infected by a rootkit.

A computer is presenting a user with a screen requesting payment before the user data is allowed to be accessed by the same user. What type of malware is this?

• a type of virus

• a type of worm

• a type of logic bomb

• a type of ransomware

Answer explanation

Refer to Chapter 3 - Slides 11 - Type of Malware
Ransomware holds a computer system, or the data it contains, captive until the target makes a payment. Ransomware usually works by encrypting data in the computer with a key unknown to the user. The user must pay a ransom to the criminals to remove the restriction.
Some other versions of ransomware can take advantage of specific system vulnerabilities to lock down the system. Ransomware propagates as a Trojan horse and is the result of a downloaded file or some software weakness.
Payment through an untraceable payment system is always the criminal’s goal. Once the victim pays, the criminal supplies a program that decrypts the files or sends an unlock code. 

What is the name given to a program or program code that bypasses normal authentication?

• backdoor

• frontdoor

• rootkit

• logic bomb

Answer explanation

Refer to Chapter 3 - Slides 12 - Type of Malware
A backdoor refers to the program or code introduced by a criminal who has compromised a system. The backdoor bypasses the normal authentication used to access a system. A few common backdoor programs are Netbus and Back Orifice, which both allow remote access to unauthorized system users. The purpose of the backdoor is to grant the cyber criminals future access to the system even if the organization fixes the original vulnerability used to attack the system. Usually, criminals have authorized users unknowingly run a Trojan horse program on their machine to install the backdoor.

Which term describes the sending of a short deceptive SMS message used to trick a target into visiting a website?

• smishing

• grayware

• zeroday attack

• keyboard logging

Answer explanation

Refer to Chapter 3 - Slides 39 - Wireless and Mobile Attacks
SMiShing is short for SMS phishing. It uses Short Message Service (SMS) to send fake text messages. The criminals trick the user into visiting a website or calling a phone number. Unsuspecting victims may then provide sensitive information such as credit card information. Visiting a website might result in the user unknowingly downloading malware that infects the device.

What is the meaning of the term logic bomb?

• a malicious virus

• a malicious worm

• a malicious program that hides itself in a legitimate program

• a malicious program that uses a trigger to awaken the malicious code

Answer explanation

Refer to Chapter 3 - Slides 9 - Type of Malware
A logic bomb is a malicious program that uses a trigger to awaken the malicious code. For example, triggers can be dates, times, other programs running, or the deletion of a user account. The logic bomb remains inactive until that trigger event happens. Once activated, a logic bomb implements a malicious code that causes harm to a computer. A logic bomb can sabotage database records, erase files, and attack operating systems or applications. Cybersecurity specialists recently discovered logic bombs that attack and destroy the hardware components in a workstation or server including the cooling fans, CPU, memory, hard drives and power supplies. The logic bomb overdrives these devices until they overheat or fail.

What is the name for the type of software that generates revenue by generating annoying pop-ups?

• adware

• pop-ups

• spyware

• trackers

Answer explanation

Refer to Chapter 3 - Slides 15 - Email and Browser Attacks
Adware typically displays annoying pop-ups to generate revenue for its authors

What are two common indicators of spam mail? (Choose two.)

• The email has no subject line.

• The email has keywords in it

• The email is from your supervisor.

• The email has misspelled words or punctuation errors or both.

Answer explanation

Refer to Chapter 3 - Slides 13 - Email and Browser Attacks
Some of the more common indicators of spam:
1) An email has no subject line.

2) An email is requesting an update to an account.

3) The email text has misspelled words or strange punctuation.

4) Links within the email are long and/or cryptic.

5) An email looks like correspondence from a legitimate business.

6) The email requests that the user open an attachment.

A criminal is using software to obtain information about the computer of a user. What is the name of this type of software?

• spyware

• adware

• logic bomb

• smishing

Answer explanation

Refer to Chapter 3 - Slides 14 - Email and Browser Attacks
Spyware is software that enables a criminal to obtain information about a user’s computer activities. Spyware often includes activity trackers, keystroke collection, and data capture. In an attempt to overcome security measures, spyware often modifies security settings. Spyware often bundles itself with legitimate software or with Trojan horses. Many shareware websites are full of spyware

smishing is not a software

What is the term used to describe an email that is targeting a specific person employed at a financial institution?

• spear phishing

• smishing

• vishing

• pharming

Answer explanation

Refer to Chapter 3 - Slides 18 - Email and Browser Attacks
Spear phishing is a highly targeted phishing attack. While phishing and spear phishing both use emails to reach the victims, spear phishing sends customized emails to a specific person. The criminal researches the target’s interests before sending the email. For example, a criminal learns that the target is interested in cars and has been looking to buy a specific model of car. The criminal joins the same car discussion forum where the target is a member, forges a car sale offering, and sends an email to the target. The email contains a link for pictures of the car. When the target clicks on the link, he or she unknowingly installs malware on the computer.