Malware Threats (Trojans, Viruses, Ransomware) CEH Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary goal of ransomware?

   • ATo steal credentials and exfiltrate data
   • BTo create a backdoor for remote access
   • CTo replicate itself across the network
   • DTo encrypt files and demand payment for decryption
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How does ransomware typically spread within a network after the initial infection?

   • ABy exploiting unpatched vulnerabilities and using SMB or RDP
   • BBy infecting the master boot record
   • CBy using USB drives
   • DBy attaching to email attachments
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A hospital's radiology department is hit by ransomware that encrypts imaging files on a network share. The ransomware demands payment in cryptocurrency. The hospital has backups, but they are stored on the same network share and were also encrypted. Which immediate action should the IT team take to contain the incident and facilitate recovery?

   • ARestore the files from the backups stored on the same share.
   • BPay the ransom immediately to obtain the decryption key and restore access to the files.
   • CRun a full antivirus scan on the network share to remove the ransomware.
   • DDisconnect the affected network share from the network and assess the scope of encryption.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In the malware lifecycle, what is the purpose of the persistence stage?

   • ATo deliver the malware to the target system
   • BTo evade antivirus detection
   • CTo ensure the malware survives reboots and remains active
   • DTo encrypt the victim's files
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A user reports that their system has been running slowly and that an unknown process is making outbound connections to a remote server. The user recalls opening a PDF attachment from an unsolicited email. Which type of malware is most likely present, and which persistence mechanism would you first check?

   • ARansomware; check for scheduled tasks that launch the encryption routine
   • BTrojan; check the Run registry keys and startup folders for the malicious executable
   • CWorm; check for network shares that the worm uses to replicate
   • DVirus; check the Master Boot Record for a bootkit infection
   Reveal Solution Discussion Select an answer first