Which countermeasure is specifically designed to detect and remove malware by comparing files and processes against a database of known malicious signatures?

Intrusion prevention system (IPS)

Data loss prevention (DLP) system

Systems Security Certified Practitioner

Domain 7Objective 1

7.1 - Identify and Analyze Malicious Code and Activity SSCP Practice Questions (Page 4)

Part of the Systems and Application Security domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

15%of the exam

Questions 16–20

16application · medium
A security analyst discovers that a finance workstation has been running normally, but a memory dump reveals encrypted shellcode injected into a legitimate Windows process (svchost.exe). The injected code executes directly from memory, and no malicious files are found on the disk. Which type of malware is the analyst most likely dealing with?
Select an answer first
17foundation · easy
Which type of malware is characterized by its ability to self-replicate and spread across networks without requiring a host file or user interaction?
Select an answer first
18foundation · easy
A security analyst observes a file that appears to be a legitimate PDF but, when opened, executes a script that downloads additional payloads from a remote server. Which malware characteristic best describes this behavior?
Select an answer first
19application · easy
A user reports that their system is displaying a full-screen message claiming their files are encrypted and demanding a $500 payment in cryptocurrency to restore access. The user's files have a .encrypted extension. Which type of malware is this?
Select an answer first
20foundation · easy
Which countermeasure is specifically designed to detect and remove malware by comparing files and processes against a database of known malicious signatures?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

7.1 - Identify and Analyze Malicious Code and Activity SSCP Practice Questions (Page 4)

Questions 16–20

Which type of malware is characterized by its ability to self-replicate and spread across networks without requiring a host file or user interaction?

A security analyst observes a file that appears to be a legitimate PDF but, when opened, executes a script that downloads additional payloads from a remote server. Which malware characteristic best describes this behavior?

A user reports that their system is displaying a full-screen message claiming their files are encrypted and demanding a $500 payment in cryptocurrency to restore access. The user's files have a .encrypted extension. Which type of malware is this?

Which countermeasure is specifically designed to detect and remove malware by comparing files and processes against a database of known malicious signatures?

Keep studying — Systems and Application Security