A network administrator notices a workstation sending large amounts of data to an IP address in a foreign country at 3:00 AM. The workstation also has a new service running that was not installed by IT. Which two indicators of compromise (IoCs) are most directly evidenced by these observations?

High CPU usage and disk activity

File anomalies and registry modifications

Unauthorized software and email attachments

Unusual network traffic and system changes

In the context of cybersecurity, what is the primary purpose of malware?

To provide legitimate remote administration capabilities

To improve system performance and reliability

To cause harm, steal data, or gain unauthorized access to a system

To protect a system from unauthorized access

A security team is reviewing a recent breach. The initial infection occurred when an employee clicked a link in a phishing email that led to a drive-by download. The downloaded file then installed a keylogger. Which attack vector and malware type pair is correct?

Network propagation and ransomware

A malware sample uses a custom encryption algorithm to hide its payload. The encryption key is derived from the current date and time. When the malware runs, it decrypts the payload in memory and executes it. Which detection technique is most likely to succeed against this malware?

Hash-based detection of the original binary

Behavioral analysis in a sandbox

String extraction from the encrypted file

Static signature scanning of the encrypted file

EC-CouncilEthical Hacking Essentials

Domain 2Objective 1

Malware Concepts, Types, and Attack Mechanisms EHE Practice Questions (Page 7)

Part of the Malware and Password Attacks domain, which makes up ~14% of our current practice bank.

43questions here

9free pages

6concepts

Questions 31–35

31application · medium
A network administrator notices a workstation sending large amounts of data to an IP address in a foreign country at 3:00 AM. The workstation also has a new service running that was not installed by IT. Which two indicators of compromise (IoCs) are most directly evidenced by these observations?
Select an answer first
32foundation · easy
In the context of cybersecurity, what is the primary purpose of malware?
Select an answer first
33foundation · easy
Which stage of the malware lifecycle is characterized by the malware performing its intended malicious action, such as data theft or file encryption?
Select an answer first
34application · medium
A security team is reviewing a recent breach. The initial infection occurred when an employee clicked a link in a phishing email that led to a drive-by download. The downloaded file then installed a keylogger. Which attack vector and malware type pair is correct?
Select an answer first
35expert · hard
A malware sample uses a custom encryption algorithm to hide its payload. The encryption key is derived from the current date and time. When the malware runs, it decrypts the payload in memory and executes it. Which detection technique is most likely to succeed against this malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to EHE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “EHE” is a trademark of its owner, used for identification only.