A hospital's file server has been encrypted, and a ransom note demands payment in cryptocurrency. The IT team notices that the malware spread to other servers using a legitimate administrative tool. Which two actions should the team prioritize to contain the outbreak and prevent recurrence?

Run a full antivirus scan on all systems and then reboot the file server

Disconnect affected systems from the network and change all administrative credentials

Pay the ransom immediately and then restore from backups

Disable the administrative tool and ignore the ransom note

A company wants to reduce the risk of ransomware spreading from an infected workstation to file servers. Which network control should be implemented?

Segment the network so that workstations and file servers are on separate VLANs with strict firewall rules.

Install antivirus on the file server only.

Use a VPN for all file server access.

Disable the file server's network shares after business hours.

What is the primary characteristic of a macro virus?

It is written in a scripting language and infects documents

It infects the master boot record

It attaches to executable files

It changes its code each time it infects a new file

EC-CouncilCertified Ethical Hacker

Domain 3Objective 7

Malware Threats (Trojans, Viruses, Ransomware) CEH Practice Questions (Page 9)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 41–45

41foundation · easy
Which detection method is most effective at identifying unknown or zero-day malware?
Select an answer first
42application · medium
A hospital's file server has been encrypted, and a ransom note demands payment in cryptocurrency. The IT team notices that the malware spread to other servers using a legitimate administrative tool. Which two actions should the team prioritize to contain the outbreak and prevent recurrence?
Select an answer first
43application · medium
A company wants to reduce the risk of ransomware spreading from an infected workstation to file servers. Which network control should be implemented?
Select an answer first
44foundation · easy
Which evasion technique involves malware detecting that it is running in a virtual machine or debugger and altering its behavior?
Select an answer first
45foundation · easy
What is the primary characteristic of a macro virus?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Malware Threats (Trojans, Viruses, Ransomware) CEH Practice Questions (Page 9)

Questions 41–45

Which detection method is most effective at identifying unknown or zero-day malware?

A hospital's file server has been encrypted, and a ransom note demands payment in cryptocurrency. The IT team notices that the malware spread to other servers using a legitimate administrative tool. Which two actions should the team prioritize to contain the outbreak and prevent recurrence?

A company wants to reduce the risk of ransomware spreading from an infected workstation to file servers. Which network control should be implemented?

Which evasion technique involves malware detecting that it is running in a virtual machine or debugger and altering its behavior?

What is the primary characteristic of a macro virus?

Keep studying — System Hacking Phases and Attack Techniques