Malware Types, Components, and Distribution DFE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A malware analyst is reverse-engineering a sample that, when executed, drops a second executable, which then modifies the boot sector to load a driver that hides the first executable's processes. The first executable also creates a scheduled task to re-download the second executable if it is deleted. Which malware components are demonstrated?

   • ADropper, persistence mechanism, and stealth technique
   • BPropagation mechanism, payload, and command-and-control channel
   • CWorm propagation, adware payload, and social engineering
   • DInfection vector, encryption routine, and ransomware payload
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's marketing team frequently visits a specific industry news website. Over the past week, several team members reported that their browsers became unresponsive and then started downloading unexpected files. The website itself was not defaced. Which distribution vector is most likely being used?

   • ADrive-by download from a compromised legitimate site
   • BEmail attachment sent to the marketing team
   • CRemovable media shared among team members
   • DSocial engineering via phone calls
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is reviewing a malware sample that arrives as a malicious macro in a Word document. When the macro runs, it downloads a second-stage payload from a remote server. Which malware component is the macro?

   • AStealth technique
   • BPayload
   • CInfection vector
   • DPropagation mechanism
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst notices that a workstation is sending large amounts of network traffic to an external server at regular intervals, and the system's CPU usage is high even when the user is idle. The user did not install any new software. The malware is also configured to receive commands from the external server. Which malware type and component are most clearly indicated?

   • ARootkit with a stealth technique
   • BVirus with a propagation mechanism
   • CAdware with a payload that displays pop-ups
   • DBotnet client with a command-and-control channel
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An organization's employees are being targeted with emails that appear to be from the company's IT department, asking them to click a link to 'renew their password'. The link leads to a fake login page that captures credentials. The attackers then use those credentials to access the corporate network and deploy ransomware. Which distribution vector and social engineering tactic are demonstrated?

   • APhishing email with a credential-harvesting page, leading to ransomware deployment
   • BSpear phishing with a malicious attachment
   • CWatering-hole attack on a trusted website
   • DVishing with a pretext of urgency
   Reveal Solution Discussion Select an answer first