Malware Concepts, Types, and Attack Mechanisms EHE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A user reports that their files have been renamed with a .encrypted extension and a ransom note has appeared. The security team determines that the infection started from a malicious email attachment. Which malware type and attack vector pair is correct?

   • ATrojan delivered via removable media
   • BRansomware delivered via email attachment
   • CWorm delivered via malicious website
   • DSpyware delivered via network propagation
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst is reviewing a system that is suspected of being infected. The analyst notices that the system's hosts file has been modified to redirect known security websites to a malicious IP address. Which indicator of compromise (IoC) is most directly related to this change?

   • ARegistry modification
   • BProcess anomaly
   • CUnusual network traffic
   • DSystem file modification
   Reveal Solution Discussion Select an answer first
4. 38application · medium · select all that apply

   A security analyst is investigating a potential malware infection on a server. Which of the following findings are indicators of compromise (IoCs)? Select all that apply.

   • AA scheduled task that runs a PowerShell script
   • BA new user account with administrative privileges
   • CAn increase in outbound traffic to a known malicious domain
   • DA recently installed security patch from the vendor
   • EA file with a name that matches a known malware hash
   Check answers Discussion Select an answer first
5. 39application · medium · select all that apply

   A security analyst is reviewing a compromised host. Which of the following are common indicators of compromise (IoCs) that the analyst should look for? Select all that apply.

   • AA recently modified system file that is digitally signed by Microsoft
   • BA new scheduled task that runs a suspicious script
   • CAn unknown process running from the user's temporary folder
   • DAn unexpected outbound connection to a known malicious IP
   • EA high volume of legitimate user activity during business hours
   Check answers Discussion Select an answer first
6. 40application · medium

   A small business reports that several employees received emails with a PDF attachment that, when opened, launched a script that downloaded additional files. The security analyst needs to identify the initial delivery method and the type of malware that was downloaded. Which two classifications best describe this attack?

   • ARansomware delivered via malicious website
   • BWorm propagated via network shares
   • CSpyware installed via removable media
   • DTrojan delivered via email attachment
   Reveal Solution Discussion Select an answer first