Deck 10: Malicious Software

Question 1

Malware can be put into two broad categories, based first on how it spreads or propagates to reach the desired targets and then on the actions or payloads it performs once a target is reached.

Answer 1

True

Question 2

To replicate itself, a worm uses some means to access remote systems.

Answer 2

True

Question 3

Newer worms are limited to Windows machines

Answer 3

False

Question 4

Propagation mechanisms include system corruption, bots, phishing, spyware, and rootkits.

Question 5

A backdoor is any mechanism that bypasses a normal security check.

Question 6

Worms cannot spread through shared media, such as USB drives or CD and DVD data disks.

Question 7

Many forms of infection can be blocked by denying normal users the right to modify programs on the system.

Question 8

_________ is software that collects information from a computer and transmits it to another system

A)Exploit
B)Flooder
C)Trojan horse
D)Spyware

Question 9

__________ is software (macro, or other portable instruction) that can be shipped unchanged to a heterogeneous collection of platforms and execute with identical semantics

A)Mobile code
B)Adware
C)Rootkit
D)Spyware

Question 10

Viruses often morph to evade detection.

Question 11

_________ can result in pop-up ads or redirection of a browser to a commercial site

A)Adware
B)Bots
C)Flooders
D)Kits

Question 12

A__________ is a program that installs other items on a machine that is under attack

A)logic bomb
B)downloader
C)flooder
D)none of the above

Question 13

A virus, although attached to an executable program, cannot do anything that the program is permitted to do.

Question 14

Payloads include those used by viruses, worms, and trojans.

Question 15

A polymorphic virus creates copies during replication that are functionally equivalent but have distinctly different bit patterns, in order to defeat programs that scan for viruses.

Question 16

Usually, a downloader is sent in an e-mail.

Question 17

A zombie is a program activated on an infected machine that is activated to launch attacks on other machines.

Question 18

Malicious software constitutes one of the most significant categories of threats to computer systems.

Question 19

Microsoft Word, Excel files, and Adobe PDF are document files that are safe from being infected by viruses.

Question 20

A ________ lies dormant until a predefined condition is met; the program then triggers an unauthorized act

A)rootkit
B)worm
C)logic bomb
D)keylogger

Question 21

As an alternative to just destroying data, some malware encrypts the user's data and demands payment in order to access the key needed to recover this information.This is sometimes known as _________

A)a trapdoor
B)a logic bomb
C)ransomware
D)spear-phishing

Question 22

There are _________ generations of antivirus software

A)two
B)three
C)four
D)five

Question 23

The _________ is the event or condition that determines when the payload is activated or delivered

A)propagation phase
B)trigger
C)infection mechanism
D)execution

Question 24

A __________ virus is a virus that mutates with every infection, making detection by the "signature" of the virus impossible

A)encrypted
B)polymorphic
C)stealth
C)metamorphic

Question 25

A Worm typically uses the __________

A)dormant phase
B)execution phase
C)triggering phase
D)all of the above

Question 26

The _________ method uses information contained on an infected victim machine to find more hosts to scan

A)hit list
B)local subnet
C)topological
D)random

Question 27

_________ viruses infect scripting code used to support active content in a variety of user document types.

Question 28

___________ programs are used to send large volumes of unwanted e-mail.

Question 29

The earliest significant worm infection was released onto the Internet by _________ in 1988.

Question 30

A _________ is malware that, when executed, tries to replicate itself into other executable code; when it succeeds the code is said to be infected.

Question 31

The first function in the propagation phase for a network worm is for it to search for other systems to infect, a process known as scanning or __________.

Question 32

In a ________ attack the attacker is able to implant zombie software on a number of sites distributed throughout the Internet

A)direct DDoS
B)bot
C)reflector DDoS
D)DoS

Question 33

A _________ is a computer program that can run independently and can propagate a complete working version of itself onto other hosts on a network.

Question 34

__________ capture keystrokes on a compromised system.

Question 35

During the __________ phase the virus places a copy of itself into other programs or into certain system areas on the disk

A)dormant
B)propagation
C)triggering
D)execution

Question 36

A _________ attack is an attack on a computer system or network that causes a loss of service to users

A)DDoS
B)spam
C)logic bomb
D)stealth

Question 37

A __________ is a set of hacker tools used after an attacker has broken into a computer system and gained root-level access.

Question 38

A _________ is a computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms.

Question 39

A(n) _________ virus is a form of virus explicitly designed to hide itself from detection by antivirus software

A)encrypted
B)polymorphic
C)stealth
C)metamorphic

Question 40

A __________ uses multiple methods of infection or propagation, to maximize the speed of contagion and the severity of the attack.

Question 41

Another approach to exploiting software vulnerabilities exploits browser vulnerabilities so that when the user views a Web page controlled by the attacker, it contains code that exploits the browser bug to download and install malware on the system without the user's knowledge or consent.This is known as a __________ and is a common exploit in recent attack kits.

Question 42

A _________ , also known as a trapdoor, is a secret entry point into a program that allows someone who is aware of the door to gain access without going through the usual security access procedures.

Question 43

A _________ is a set of programs installed on a system to maintain covert access to that system with administrator privileges, while hiding evidence of its presence to the greatest extent possible.

Question 44

Unsolicited bulk e-mail, commonly known as ________, imposes significant costs on both the network infrastructure needed to relay this traffic and on users who need to filter their legitimate e-mails out of this flood.

Question 45

A _________ attack exploits social engineering to leverage a user's trust by masquerading as communications from a trusted source.