After a trojan is installed on a victim's machine, what is a common action it performs to maintain remote access?

It disables the firewall permanently

It patches the operating system

A user reports that their files have been renamed with a .encrypted extension and a ransom note has appeared. The user also notices that the malware seems to have spread to a network share. Which type of malware is this, and what is the primary goal of the attacker?

Trojan; to create a backdoor for remote access

Ransomware; to encrypt files and demand payment for decryption

Worm; to spread across the network without user interaction

Virus; to replicate and infect other files on the system

A company's backup server was also encrypted during a ransomware attack because the backups were mounted as network drives. Which change to the backup strategy would best protect against future ransomware attacks?

Store backups offline or in an immutable storage solution

Use a different backup software

Increase the frequency of backups

Store backups on the same network but with different credentials

EC-CouncilCertified Ethical Hacker

Domain 3Objective 7

Malware Threats (Trojans, Viruses, Ransomware) CEH Practice Questions (Page 4)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 16–20

16foundation · easy
Which type of virus is designed to change its signature each time it replicates to evade signature-based detection?
Select an answer first
17foundation · easy
After a trojan is installed on a victim's machine, what is a common action it performs to maintain remote access?
Select an answer first
18application · easy
A user reports that their files have been renamed with a .encrypted extension and a ransom note has appeared. The user also notices that the malware seems to have spread to a network share. Which type of malware is this, and what is the primary goal of the attacker?
Select an answer first
19application · medium
A malware analyst is examining a suspicious executable that changes its file hash every time it is downloaded from a command-and-control server. The executable also contains a loop that checks for the presence of a debugger. Which evasion technique is the malware using?
Select an answer first
20application · medium
A company's backup server was also encrypted during a ransomware attack because the backups were mounted as network drives. Which change to the backup strategy would best protect against future ransomware attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Malware Threats (Trojans, Viruses, Ransomware) CEH Practice Questions (Page 4)

Questions 16–20

Which type of virus is designed to change its signature each time it replicates to evade signature-based detection?

After a trojan is installed on a victim's machine, what is a common action it performs to maintain remote access?

A user reports that their files have been renamed with a .encrypted extension and a ransom note has appeared. The user also notices that the malware seems to have spread to a network share. Which type of malware is this, and what is the primary goal of the attacker?

A malware analyst is examining a suspicious executable that changes its file hash every time it is downloaded from a command-and-control server. The executable also contains a loop that checks for the presence of a debugger. Which evasion technique is the malware using?

A company's backup server was also encrypted during a ransomware attack because the backups were mounted as network drives. Which change to the backup strategy would best protect against future ransomware attacks?

Keep studying — System Hacking Phases and Attack Techniques