Malware Propagation Techniques and Indicators EHE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A network analyst observes repeated DNS queries for a domain that is only a few days old and has no known legitimate use. This is an example of which type of malware indicator?

   • AFile modification indicator
   • BBehavioral indicator
   • CSystem-level indicator
   • DNetwork indicator
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has a mix of Windows and Linux servers. Over the past week, several Windows servers have been infected with ransomware that spreads by copying itself to open SMB shares. The Linux servers are unaffected. The security team has identified that the initial infection occurred when an employee downloaded a cracked software installer from a peer-to-peer site. The ransomware also communicates with an external C2 server over HTTPS. Which combination of propagation vector, technique, and network indicator best describes this incident?

   • AVector: removable media; technique: autorun infection; network indicator: outbound connections on port 445.
   • BVector: email attachment; technique: trojan disguised as a document; network indicator: DNS queries to a known malicious domain.
   • CVector: malicious download; technique: worm-like spread via SMB shares; network indicator: outbound HTTPS connections to a C2 server.
   • DVector: network vulnerability; technique: exploitation of an unpatched SMB service; network indicator: large outbound data transfers.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A small business downloads a free 'PDF converter' from a pop-up ad. After installation, employees notice frequent pop-ups and the company's firewall logs show repeated connections to an unfamiliar external IP on port 443. Which two indicators together most strongly suggest a trojan infection?

   • AThe software was downloaded from an untrusted source and the system is making outbound connections to an unknown IP.
   • BThe installation required administrative privileges and the system has a static IP address.
   • CThe pop-up ad appeared and the firewall is blocking inbound connections from the internet.
   • DThe software is free and the system is running slowly during peak hours.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A network administrator notices that multiple servers on the same subnet are infected with malware that spreads by exploiting an unpatched SMB vulnerability. The malware creates a new service on each compromised host and communicates with an external server. Which type of malware is this?

   • AWorm
   • BTrojan
   • CRootkit
   • DRansomware
   Reveal Solution Discussion Select an answer first
6. 5application · easy

   A forensic investigator is examining a machine that was infected after the user inserted a USB drive. The investigator finds that the USB drive contained an autorun.inf file and a hidden executable. Which propagation vector and system indicator are present?

   • ANetwork vulnerability as the vector, and the autorun.inf file as a behavioral indicator.
   • BDrive-by download as the vector, and the hidden executable as a propagation indicator.
   • CRemovable media as the vector, and the autorun.inf file as a system indicator of the infection mechanism.
   • DEmail attachment as the vector, and the hidden executable as a network indicator.
   Reveal Solution Discussion Select an answer first