A system administrator notices that a server is sending a large volume of outbound traffic to an IP address that is not on any approved list. The server's CPU usage is high, and several new scheduled tasks have appeared. Which indicator of compromise (IoC) is most directly observed in this scenario?

Presence of a rootkit hiding system processes

File integrity changes in system directories

Ransom note left on the desktop

Unusual network traffic to an unknown destination

A malware analyst is mapping the lifecycle of a new threat. The threat arrives via a malicious macro in a Word document. Once opened, the macro downloads a second-stage payload from a remote server. Which two lifecycle stages are demonstrated?

Command-and-control and exfiltration

Persistence and privilege escalation

Initial infection and payload delivery

EC-CouncilEthical Hacking Essentials

Domain 2Objective 1

Malware Concepts, Types, and Attack Mechanisms EHE Practice Questions (Page 5)

Part of the Malware and Password Attacks domain, which makes up ~14% of our current practice bank.

43questions here

9free pages

6concepts

Questions 21–25

21application · medium
A system administrator notices that a server is sending a large volume of outbound traffic to an IP address that is not on any approved list. The server's CPU usage is high, and several new scheduled tasks have appeared. Which indicator of compromise (IoC) is most directly observed in this scenario?
Select an answer first
22application · medium
A user reports that their web browser's homepage has changed and they see unwanted ads even when not browsing. The security team finds a program that was installed alongside a free application the user downloaded. Which malware type is this?
Select an answer first
23application · medium
A malware analyst is mapping the lifecycle of a new threat. The threat arrives via a malicious macro in a Word document. Once opened, the macro downloads a second-stage payload from a remote server. Which two lifecycle stages are demonstrated?
Select an answer first
24application · medium
A security analyst is investigating a malware outbreak that started after an employee downloaded a file from a peer-to-peer file-sharing network. The file was disguised as a popular application but contained a backdoor. Which attack vector and malware type are demonstrated?
Select an answer first
25foundation · easy
Which of the following is a common malware attack vector?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.

Malware Concepts, Types, and Attack Mechanisms EHE Practice Questions (Page 5)

Questions 21–25

A user reports that their web browser's homepage has changed and they see unwanted ads even when not browsing. The security team finds a program that was installed alongside a free application the user downloaded. Which malware type is this?

A malware analyst is mapping the lifecycle of a new threat. The threat arrives via a malicious macro in a Word document. Once opened, the macro downloads a second-stage payload from a remote server. Which two lifecycle stages are demonstrated?

A security analyst is investigating a malware outbreak that started after an employee downloaded a file from a peer-to-peer file-sharing network. The file was disguised as a popular application but contained a backdoor. Which attack vector and malware type are demonstrated?

Which of the following is a common malware attack vector?

Keep studying — Malware and Password Attacks