2.8 Describe Endpoint-Based Attacks, Such as Buffer Overflows, Command and Control (C2), Malware, and Ransomware 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization experiences a ransomware attack. The security team finds that the initial infection occurred through a phishing email, followed by the malware encrypting files on the network shares. The attackers then left a note demanding payment in cryptocurrency. Which sequence best represents the ransomware attack lifecycle?

   • AInitial infection, encryption, ransom demand
   • BEncryption, initial infection, ransom demand
   • CRansom demand, initial infection, encryption
   • DInitial infection, ransom demand, encryption
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which memory area is most commonly targeted when an attacker exploits a buffer overflow to overwrite a return address?

   • AText segment
   • BStack
   • CHeap
   • DData segment
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How does user awareness training help mitigate ransomware attacks?

   • AIt provides a backup of the user's files
   • BIt helps users recognize and avoid phishing emails that often deliver ransomware
   • CIt automatically blocks ransomware from executing on the endpoint
   • DIt decrypts files that have been encrypted by ransomware
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company wants to reduce the impact of a potential ransomware attack. They have a limited budget and need to choose a mitigation strategy. Which approach is most effective for recovering from ransomware?

   • AMaintain offline, tested backups of critical data
   • BInstall a free antivirus product on all endpoints
   • CPurchase a cryptocurrency wallet to pay ransoms
   • DDisable all network shares to prevent file access
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A small business experienced a ransomware attack that encrypted all files on their file server. They were able to restore from offline backups with minimal data loss. Which two mitigation strategies were most effective in this scenario?

   • ADisabling the file server and reimaging all workstations.
   • BMaintaining offline backups and user awareness training to avoid phishing emails.
   • CPaying the ransom and using a decryption tool provided by the attacker.
   • DUsing endpoint detection and response (EDR) and network segmentation.
   Reveal Solution Discussion Select an answer first