Malware Propagation Techniques and Indicators EHE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst notices a workstation repeatedly making outbound connections to a known malicious IP on port 443 at regular intervals. The process initiating the connections is a legitimate-looking executable named 'svchost.exe' located in the user's AppData folder. Which propagation technique is most likely responsible for the initial infection?

   • AA logic bomb triggered by a specific date that activated the outbound connections.
   • BA trojan disguised as a legitimate system process that was downloaded from a malicious website.
   • CA virus that attached itself to a legitimate document opened by the user.
   • DA worm that exploited an unpatched SMB vulnerability to copy itself to the workstation.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a system-level indicator that a system may be infected with malware?

   • AA new desktop wallpaper
   • BA scheduled disk defragmentation
   • CAn increased number of browser bookmarks
   • DAn unusual process running in Task Manager
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A user reports that their computer is running slowly and that they see pop-ups advertising fake antivirus software. The IT team checks the system and finds a new process named 'SecurityScan.exe' running from the Temp folder. Which set of indicators is present?

   • ASystem-level indicators only (the process and the pop-ups).
   • BBehavioral indicators (slow performance and pop-ups) and a system-level indicator (the new process in Temp).
   • CNetwork indicators (the pop-ups) and a propagation indicator (the Temp folder).
   • DPropagation indicators (the slow performance) and network indicators (the process).
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A helpdesk technician is troubleshooting a user's computer that is running slowly and showing pop-ups. The technician finds a new process running from the user's AppData folder and a registry Run key that points to that process. The user recalls downloading a free screensaver from a website. Which combination of propagation vector, system indicator, and behavioral indicator is present?

   • AVector: malicious download; system indicator: the new process and registry Run key; behavioral indicator: slow performance and pop-ups.
   • BVector: email attachment; system indicator: the pop-ups; behavioral indicator: the registry Run key.
   • CVector: network vulnerability; system indicator: the registry Run key; behavioral indicator: the pop-ups.
   • DVector: removable media; system indicator: the slow performance; behavioral indicator: the new process.
   Reveal Solution Discussion Select an answer first
6. 15application · easy

   A company's security team is investigating a malware outbreak that started when an employee clicked a link in a phishing email. The malware then used the employee's credentials to access an internal file share and copy itself to other folders. Which propagation vector and technique are involved?

   • ANetwork vulnerability as the vector, and SMB exploitation as the technique.
   • BDrive-by download as the vector, and browser exploitation as the technique.
   • CRemovable media as the vector, and USB propagation as the technique.
   • DEmail attachment/link as the vector, and network share propagation as the technique.
   Reveal Solution Discussion Select an answer first