7.1 - Identify and Analyze Malicious Code and Activity SSCP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which malware characteristic is most commonly associated with a virus, as opposed to a worm?

   • AIt spreads autonomously over the network without user interaction
   • BIt disguises itself as legitimate software to trick users
   • CIt requires a host file to attach to and often needs user action to spread
   • DIt encrypts files and demands a ransom for decryption
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When a malware infection is confirmed on a critical server, which containment strategy should be implemented FIRST to prevent further spread?

   • ANotify the incident response team and wait for instructions
   • BDisconnect the server from the network
   • CRun a full system scan with anti-malware software
   • DReboot the server to clear the malware from memory
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A security analyst is responding to a ransomware incident on a critical file server. The ransomware has encrypted a large number of files, and the organization's backup system was also affected, with recent backups being encrypted as well. The analyst must decide on the next step. What is the most appropriate immediate action?

   • AReboot the server to clear the ransomware from memory
   • BAttempt to decrypt the files using a free decryption tool
   • CPay the ransom to restore access quickly
   • DIsolate the infected server from the network immediately
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company's endpoint protection software has detected a new, unknown executable on a user's machine. The software analyzes the executable's code structure and behavior in a controlled environment before allowing it to run. Which countermeasure is being used?

   • AData Loss Prevention (DLP)
   • BSignature-based detection
   • CSystem hardening
   • DHeuristic analysis / sandboxing
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A security team is evaluating a new behavior analytics tool to detect insider threats. The tool flags an employee who has started accessing files outside their normal work hours and downloading large amounts of data to a USB drive. The employee's manager confirms the employee is working on a legitimate project that requires after-hours access. What is the most appropriate response?

   • ADisable the behavior analytics tool to avoid false positives
   • BInvestigate the alert further by correlating with other data sources, such as the employee's project documentation and HR records
   • CImmediately revoke the employee's access and escalate to HR
   • DIgnore the alert since the manager confirmed the activity is legitimate
   Reveal Solution Discussion Select an answer first