Malware Scanning CT-SEC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security tester needs to scan a memory image from a compromised system for malware. Which type of tool is most appropriate for this task?

   • AA memory forensics tool such as Volatility
   • BA file-based antivirus scanner
   • CA network-based intrusion detection system (IDS)
   • DA web application firewall (WAF)
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A tester runs a malware scanner on a set of 500 known malware samples and 500 known benign files. The scanner detects 480 of the malware samples and flags 20 of the benign files as malicious. What is the false positive rate?

   • A10%
   • B4%
   • C20%
   • D96%
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security tester is designing a test to evaluate a malware scanner's ability to detect ransomware. The tester has a set of known ransomware samples, but the scanner is only able to detect 70% of them. The tester suspects that the scanner's heuristics are not tuned for ransomware. What is the most effective way to improve the test to better evaluate the scanner's ransomware detection?

   • AUse only signature-based detection to avoid false positives.
   • BTest the scanner on a system with no internet access to prevent sample upload.
   • CIncrease the number of ransomware samples in the test set.
   • DAdjust the scanner's heuristic sensitivity to a higher level and re-run the test.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A tester is configuring a malware scanner in a test environment. The scanner will be used to scan files that are uploaded to a web application. The tester wants to minimize the impact on the application's performance. Which configuration is most appropriate?

   • AConfigure the scanner to scan files in a separate queue with limited CPU usage and a defined timeout.
   • BDisable scanning for files larger than 10 MB to improve performance.
   • CEnable real-time scanning on all file uploads and set the scanner to use maximum CPU resources.
   • DRun the scanner on the same server as the application to avoid network latency.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A tester is evaluating a malware scanner's ability to detect fileless malware. The scanner reports no detections when scanning a memory image that is known to contain fileless malware. What is the most likely reason for this result?

   • AThe scanner's signatures are outdated.
   • BThe memory image is corrupted.
   • CThe scanner is using heuristic detection, which is not effective against fileless malware.
   • DThe scanner is not configured to scan memory images.
   Reveal Solution Discussion Select an answer first