Malware Threats (Trojans, Viruses, Ransomware) CEH Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company has been hit by ransomware that encrypts files on network shares. The IT team has restored from backups, but the ransomware reappears after a few days. The team suspects that the ransomware is using a legitimate remote management tool for persistence. Which action is most critical to prevent reinfection?

   • AInstall the latest antivirus definitions on all systems
   • BReimage all workstations and servers from known-good backups
   • CChange all administrative credentials and enforce multi-factor authentication
   • DDisable the remote management tool on all systems
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A penetration tester is assessing an organization's defenses. The tester wants to deliver a trojan that establishes persistence and evades detection. Which combination of techniques is most likely to succeed?

   • AUse a trojan that encrypts files and demands ransom
   • BUse a trojan that spreads via network shares and modifies the hosts file
   • CUse a macro-enabled document that downloads the trojan and adds a registry Run key
   • DUse a legitimate-looking installer that drops a trojan and creates a scheduled task for persistence
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company is designing a defense against ransomware. They have a limited budget and need to choose between investing in endpoint detection and response (EDR) or implementing network segmentation and offline backups. Which consideration should drive their decision?

   • ASegmentation and backups are always more cost-effective than EDR.
   • BThe company should implement both EDR and segmentation/backups regardless of budget.
   • CEDR is always more effective than segmentation and backups.
   • DEDR provides real-time detection and response, while segmentation and backups focus on containment and recovery.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A macro virus is spreading through your organization via Word documents attached to emails. The virus modifies the Normal.dotm template to ensure it runs when any document is opened. Which detection method would be most effective in identifying this macro virus?

   • ASandboxing every email attachment before delivery.
   • BHeuristic analysis that flags documents with macros that modify templates or execute system commands.
   • CBlocking all macros in Office documents.
   • DSignature-based detection using known macro virus signatures.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   After removing a trojan from a user's workstation, the security team finds that the trojan reappears after reboot. The trojan is not in the Run registry keys or startup folders. Which persistence mechanism should the team investigate next?

   • AThe Windows firewall rules
   • BThe user's profile picture
   • CScheduled tasks that re-download or re-execute the trojan
   • DThe browser's autofill data
   Reveal Solution Discussion Select an answer first