Malware Threats (Trojans, Viruses, Ransomware) CEH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization's endpoint protection has failed to detect a new malware variant that uses a known exploit. The malware is packed and changes its behavior based on the environment. Which detection method should the security team add to improve detection?

   • AHeuristic analysis that looks for code patterns similar to known malware
   • BBehavioral monitoring that flags unusual process actions and network connections
   • CSignature-based detection with more frequent updates
   • DSandboxing every executable before it runs
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a forensic investigation, you find that a trojan has been running on a Windows system for months. The trojan's executable is located in the user's AppData folder, and a registry Run key points to it. Which persistence mechanism is the trojan using?

   • AWindows service
   • BRegistry Run key
   • CStartup folder
   • DScheduled task
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is investigating a malware outbreak where the malware changes its code structure completely each time it infects a new host, making it difficult to create a signature. The malware's functionality remains the same. Which type of malware is this, and what detection strategy is most effective?

   • AMacro virus; use sandboxing to observe document behavior
   • BPolymorphic virus; use signature-based detection with a generic signature
   • CStealth virus; use boot-time scanning
   • DMetamorphic virus; use behavioral detection that monitors for the virus's actions
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is the correct order of the malware lifecycle stages?

   • ADelivery → Infection → Execution → Persistence → Payload Activation
   • BExecution → Delivery → Infection → Persistence → Payload Activation
   • CPersistence → Delivery → Infection → Execution → Payload Activation
   • DInfection → Delivery → Execution → Payload Activation → Persistence
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A small business experiences a ransomware attack that encrypts all files on a single file server. The business does not have offsite backups. Which action should the business take to maximize the chance of recovering its data?

   • APay the ransom to obtain the decryption key.
   • BContact law enforcement and cybersecurity professionals for assistance.
   • CAttempt to restore from any local shadow copies or previous versions.
   • DReinstall the operating system and start over.
   Reveal Solution Discussion Select an answer first