Lesson 13

Which vector-based malware type hides inside an otherwise legitimate installer package?

• Worm

• Trojan

• Fileless malware

• Logic bomb

A virus that executes when a computer boots from an infected USB drive is classified as which virus type?

• Memory-resident

• Script/macro

• Boot sector

• Multipartite

Which behavior best characterizes fileless malware?

• Encrypts user files for ransom

• Persists entirely in system memory and uses PowerShell commands

• Infects executable files on disk

• Mass-mails copies of itself through email

Capturing keystrokes to steal passwords is the primary purpose of which malware payload?

• Rootkit

• Keylogger

• Adware

• Crypto-miner

A security team detects outbound connections from several hosts to an IRC server on port 6667. What is the MOST likely explanation?

• Legitimate file transfer

• Botnet command-and-control traffic

• SYN flood generation

• DNS tunneling

Which indicator most strongly suggests ransomware has executed on a workstation?

• Browser homepage changed without user input

• High CPU utilization and elevated fan speed

• Numerous files suddenly renamed with a new extension and become inaccessible

• Repeated logon failures in the security log

During malware triage, analysts place a suspicious executable in an isolated VM to observe changes. This technique is called:

• Threat hunting

• Sheep-dip analysis

• Credential dumping

• Live forensics

Consistently high outbound traffic to unfamiliar cryptocurrency addresses BEST indicates the presence of:

• Crypto-ransomware

• Cryptojacking malware

• Rootkit-based spyware

• Logic bomb

Which of the following is a persistence technique commonly used by Windows malware?

• Disabling Address Space Layout Randomization (ASLR)

• Adding a malicious entry to HKLM\Software\Microsoft\Windows\CurrentVersion\Run

• Broadcasting gratuitous ARP replies

• Injecting SQL commands via HTTP POST

Excessive Access Denied events targeting a confidential share MOST LIKELY indicate:

• A memory leak

• A blocked-content indicator of attempted data theft

• Successful privilege escalation

• A DNS poisoning attack