2.8 Describe Endpoint-Based Attacks, Such as Buffer Overflows, Command and Control (C2), Malware, and Ransomware 200-201 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is a common security impact of a buffer overflow exploit that overwrites a return address?

   • AExecution of arbitrary code with the privileges of the vulnerable process
   • BImmediate shutdown of the entire operating system
   • CEncryption of files on the system
   • DPermanent loss of all data stored on the hard drive
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which type of malware is self-replicating and spreads without requiring user interaction?

   • AWorm
   • BVirus
   • CRansomware
   • DTrojan
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security team is analyzing a malware sample that, when executed, drops a file into the startup folder and also creates a service that runs a script. The script downloads additional payloads from a remote server. Which combination of malware behaviors is demonstrated?

   • ASelf-replication and file encryption, indicating a worm with ransomware capabilities.
   • BData exfiltration and privilege escalation, showing a spyware and rootkit.
   • CPolymorphism and obfuscation, indicating a stealthy virus.
   • DPersistence mechanisms (startup folder and service) and C2 communication (downloading payloads).
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An analyst is investigating a host that is sending outbound connections to multiple IP addresses on port 443. The host is also creating scheduled tasks that run a binary from a temp directory. The binary is not present in the host's application inventory. Which malware characteristic is most indicative of a backdoor?

   • AThe binary encrypts files and displays a ransom note.
   • BThe binary attaches itself to legitimate executables to spread.
   • CThe binary creates scheduled tasks for persistence and connects to external IPs, indicating remote access capability.
   • DThe binary replicates itself to other hosts on the network.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is a primary reason why regular, offline backups are an effective mitigation against ransomware?

   • AThey encrypt the system's files to protect them from ransomware
   • BThey prevent the ransomware from executing in the first place
   • CThey allow the organization to restore encrypted files without paying the ransom
   • DThey automatically detect and remove ransomware
   Reveal Solution Discussion Select an answer first