A security team must choose a detection strategy for a network that has a high volume of legitimate encrypted traffic. They need to detect malware that uses encryption to hide its C2 traffic. Which approach is most effective without breaking encryption?

Use signature-based detection on encrypted packets

Deploy endpoint behavioral detection that monitors process behavior and network connections

Implement SSL/TLS inspection on the firewall

During a ransomware incident, the incident response team discovers that the malware has already encrypted backups that were stored on the same network. The team needs to recover data. Which action is MOST appropriate?

Reinstall the operating system and hope for the best

Pay the ransom to obtain the decryption key

Restore from offline or immutable backups that were not affected

Attempt to decrypt the files using free decryption tools

EC-CouncilCertified Security Specialist

Domain 3Objective 3

Malware Threats and Countermeasures ECSS Practice Questions (Page 4)

Part of the Ethical Hacking Fundamentals and Core Attacks domain, which makes up ~17% of our current practice bank.

46questions here

10free pages

6concepts

Questions 16–20

16application · medium
A user reports that their system became infected after visiting a legitimate website that had been compromised. The website silently redirected the user's browser to a malicious server that exploited a browser vulnerability. Which infection vector best describes this attack?
Select an answer first
17foundation · easy
Which type of malware is characterized by encrypting a victim's files and demanding payment for the decryption key?
Select an answer first
18expert · hard
A security team must choose a detection strategy for a network that has a high volume of legitimate encrypted traffic. They need to detect malware that uses encryption to hide its C2 traffic. Which approach is most effective without breaking encryption?
Select an answer first
19expert · hard
During a ransomware incident, the incident response team discovers that the malware has already encrypted backups that were stored on the same network. The team needs to recover data. Which action is MOST appropriate?
Select an answer first
20foundation · easy
Which countermeasure is specifically designed to reduce the risk of malware infections caused by users opening malicious email attachments?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Malware Threats and Countermeasures ECSS Practice Questions (Page 4)

Questions 16–20

A user reports that their system became infected after visiting a legitimate website that had been compromised. The website silently redirected the user's browser to a malicious server that exploited a browser vulnerability. Which infection vector best describes this attack?

Which type of malware is characterized by encrypting a victim's files and demanding payment for the decryption key?

A security team must choose a detection strategy for a network that has a high volume of legitimate encrypted traffic. They need to detect malware that uses encryption to hide its C2 traffic. Which approach is most effective without breaking encryption?

During a ransomware incident, the incident response team discovers that the malware has already encrypted backups that were stored on the same network. The team needs to recover data. Which action is MOST appropriate?

Which countermeasure is specifically designed to reduce the risk of malware infections caused by users opening malicious email attachments?

Keep studying — Ethical Hacking Fundamentals and Core Attacks