Deck 2: Viruses, Worms, and Malicious Software

Question 1

Organizational policy works best when users are included in the process, so that they know the importance of security.

Answer 1

True

Question 2

In Netware, the startup.ncf file contains commands used by the server.exe startup program.

Answer 2

True

Question 3

A(n) stealth virus uses defenses to make itself hard to find and detect.

Answer 3

True

Question 4

The W32.Pinfi virus is an example of a destructive virus that can infect Mac OS systems.

Question 5

The Digispid.B. Worm targets systems running the SQL Server database on Windows-based workstations and servers.

Question 6

Cookie snarfing is an attack where a spyware operator can reconstruct a user's every move on the Internet by capturing cookies or the information contained in the cookies.

Question 7

Windows 2000 Server allows you to create an ERD, which enables you to fix problems that may arise with the server, such as corrupted system files.

Question 8

The Netware 6.x operating system has a software update tool that connects to the Internet to obtain patches.

Question 9

A(n) macro virus, worm, or Trojan horse is a file that contains lines of computer code that can be run.

Question 10

The first stage of virus spread that occurs is replication within the infected system.

Question 11

Boot or partition sector viruses particularly affect Windows and Netware systems.

Question 12

Batch files and scripts are files that contain code or instructions that are run by a(n) interpreter .

Question 13

Software exploitation is particularly aimed at new software and new software versions.

Question 14

File infector viruses can infect systems through multiple means, particularly through boot or partition sectors and through executable files.

Question 15

A(n) boot sector virus typically infects or replaces the instructions in the MBR or the Partition Boot Sector.

Question 16

A benign virus is one that replicates but does not inflict harm on a computer.

Question 17

Backdoor.Egghead is an example of a worm that is spread by buffer overflows.

Question 18

Mac OS and NetWare automatically display the boot load information to the screen each time one of these systems is booted.

Question 19

The Windows 2003 Server ASR set backs up all system files, system settings, and application data files.

Question 20

The Code Red worm replicates for the first 23 days of the month and then stops.

Question 21

A(n) _____ virus uses defenses to make itself hard to find and detect.

A) polymorphic
B) stealth
C) companion
D) heuristic

Question 22

Which anti-virus software is available for use on Macintosh, NetWare, UNIX/Linux, and Windows-based systems?

A) AntiVir Personal Edition
B) HandyBits VirusScan
C) McAfee VirusScan
D) Sophos Anti-Virus

Question 23

How many copies of the ASR set should you have for a server?

A) 1
B) 2
C) 3
D) 4

Question 24

What do you need to have for Red Hat Linux if a system file on the hard disk is corrupted?

A) An ERD
B) An ASR set
C) A boot disk
D) An MBR

Question 25

A _____ virus appends to program files such as system files, executable files, driver files, and supplementary files, including .dlls.

A) partition sector
B) file infector
C) macro
D) multipartite

Question 26

A _____ virus can infect systems through multiple means, particularly through boot or partition sectors and through executable files.

A) boot sector
B) multipartite
C) macro
D) file infector

Question 27

Which anti-virus software is available for use on only Windows and Mac OS systems?

A) Central Command Vexira AntiVirus
B) F-Prot AV
C) Norton AntiVirus
D) McAfee VirusScan
E) Both c and d

Question 28

Which of the following operating systems uses an emergency repair disk?

A) Windows 2000 Server
B) Windows 2000 Pro
C) Windows XP Pro
D) Windows 2003 Server
E) Both a and b

Question 29

A(n) _____ virus appears to run from a file other than the one to which it is actually appended.

A) stealth
B) armored
C) polymorphic
D) companion

Question 30

In Red Hat Linux, what command do you need to use to create a boot disk?

A) mkboot
B) makebootdisk
C) mkbootdisk
D) makebtdsk

Question 31

The _____ virus can only become destructive if the user executes an infected file on a Friday the thirteenth.

A) Linux.Millen.Worm
B) INIT 1984
C) W32.Pinfi
D) Code Red II

Question 32

What process does the Linux.Millen.Worm use on the attacked operating system?

A) Telnet
B) FTP
C) DNS
D) SMTP

Question 33

Which of the following worms uses buffer overflows to do damage?

A) Code Red
B) Code Red II
C) Linux.Millen.Worm
D) Both a and b
E) a, b, and c

Question 34

_____ is designed so that it does not infect all of these file types at once, but only a limited number each time Windows Explorer runs.

A) INIT 1984
B) Code Red
C) Slammer worm
D) W32.Pinfi

Question 35

A _____ virus spreads to instruction set files typically used by word processors, spreadsheets, databases, and other programs.

A) boot sector
B) file infector
C) macro
D) multipartite

Question 36

A(n) _____ virus changes each time it is replicated, making it more difficult to create a defense against it.

A) armored
B) multipartite
C) polymorphic
D) heuristic

Question 37

Which of the following virus programs is available for purchase on a Windows-based workstation?

A) AntiVir Personal Edition
B) Handybits Viruscan
C) VCatch Basic
D) Sophos Anti-virus
E) Both b and d

Question 38

Which of the following Microsoft operating systems uses driver signing?

A) Windows XP
B) Windows ME
C) Windows 98
D) Windows 95
E) Both a and c

Question 39

How many days of the month does the Code Red worm replicate?

A) 15
B) 19
C) 23
D) 29

Question 40

What is another name for malicious software?

A) malsoft
B) malware
C) scriptware
D) scriptsoft

Question 41

Which of the following is an example of a Trojan horse on a Mac OS system?

A) Simpsons AppleScript Virus
B) AOL4FREE
C) Backdoor.Egghead
D) Code Red

Question 42

In Red Hat Linux, what mode do you need to be in to run the fdisk/mbr utility which replaces the MBR?

A) Safe
B) Rescue
C) Recovery
D) MBR

Question 43

How was the Melissa virus transported?

A) File sharing
B) Floppy disk
C) Buffer overflow
D) E-mail

Question 44

Which of the following executable file extensions is found only on Windows-based systems?

A) )mst
B) )msi
C) )msp
D) )btm
E) All of the above

Question 45

Which of the following is an example of a Red Hat Linux file that can be the target of a virus?

A) autoexec.bat
B) inittab
C) startup.ncf
D) win.ini

Question 46

Can the VCatch Basic Anti-virus program be used both in Windows and Linux environments?

Question 47

Is Sophos Anti-virus free software that can be used in Macintosh, Netware, UNIX/Linux, and Windows-based systems?

Question 48

Which of the following is notorious for enabling cookie snarfing?

A) SpyNet
B) PeepNet
C) Cookienet
D) Both a and b
E) a, b, and c

Question 49

Which file on a Windows-based system is run when a system is booted, and can be used to rename specific files at startup?

A) win.ini
B) autoexec.bat
C) wininit.ini
D) winstart.bat

Question 50

With which attachment was the Resume virus associated?

A) Explorer.exe
B) Explorer.msi
C) Explorer.doc
D) Explorer.com

Question 51

Is one advantage of a digital signature that it helps ensure the security of your system by allowing only drivers and system files that have been verified by Microsoft?

Question 52

What is displayed in the figure above?

A) A bashrc file in Red Hat Linux
B) A win.ini file in Windows XP
C) A startup.ncf file in Netware
D) The kernel file in Mac OS X

Question 53

Which of the following executable file extensions can be found on a Netware 6.x system?

A) )pl
B) )msi
C) )wsf
D) )bin

Question 54

Which of the following is an example of a Netware 6.x file that can be the target of a virus?

A) autoexec.bat
B) startup.ncf
C) win.ini
D) Both a and b

Question 55

Does Windows 2000 use an ASR set to recover from a system failure?

Question 56

What is displayed in the figure above?

A) Windows Update Setup Wizard
B) Red Hat Network Alert Notification Tool
C) Mac OS X Software Update Tool
D) None of the above

Question 57

Which of the following operating systems would use the commands listed in the figure above?

A) Windows XP
B) Netware 6.x
C) Red Hat Linux
D) Mac OS X

Question 58

What was one reason the Slammer worm was successful against SQL Server database servers in early 2003?

A) It gained access through a previously unknown vulnerability in SQL server
B) Many administrators had not installed new patches designed to block this attack
C) It was a polymorphic worm that rapidly changed signatures
D) It was a stealth worm that was difficult to detect

Question 59

The _____ targets systems running the SQL Server database on Windows-based workstations and servers.

A) Digispid.B.Worm
B) Linux.Millen.Worm
C) Linux.Lion.Worm
D) Code Red II Worm

Question 60

Should you create a new ASR set each time you add a protocol or install a new driver for a network interface card?

Question 61

Viruses, worms, and Trojan horses all represent malicious software that use _________________________ to find weaknesses or holes in operating systems and networks.

Question 62

Typically, eradicating boot or partition sector viruses involves recreating the ____________________ and Partition Boot Sector instructions.

Question 63

What is a destructive virus?

Question 64

Windows XP Professional and Windows Server 2003 come with the ____________________ Setup Wizard which is designed to help you remember to obtain new updates, or even to obtain them for you.

Question 65

One way to spread a(n) ____________________ virus is to attach it to a template that many users share, enabling it to spread each time the template is opened in a new document.

Question 66

____________________ may operate without being installed on a user's computer by capturing information related to the user's Internet communications.

Question 67

In its destructive mode, will the INIT 1984 virus rename files using random characters and delete files on hard drives?

Question 68

A(n) ____________________ is a program that replicates and replicates on the same computer, or one that sends itself to many other computers on a network or the Internet.

Question 69

____________________ are one of the most vulnerable points of attack in an organization.

Question 70

Does the AOL4FREE e-mail hoax contain the AOL4FREE.com attachment?

Question 71

In the ____________________ operating system, you can display the boot process by booting into either single user mode or verbose mode.

Question 72

Does an organizational policy work best if users are not included in the policy creation process?

Question 73

The ____________________ virus did not destroy data, but instead inserted the following line in the virus-carrying document when it was opened: "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here."

Question 74

What are the six typical methods used in malicious software attacks?

Question 75

Viruses can be classified by the way they protect themselves from detection or from a virus scanner. List the four classifications.

Question 76

Can a boot or partition sector virus corrupt the address of the primary partition that is specified in the partition table of a disk?

Question 77

Code Red and Code Red II use a buffer overflow to attack weaknesses in ____________________ Services on Microsoft servers.

Question 78

One way to classify viruses is by how they infect systems. List the four different classifications.

Question 79

Is Windows the only operating system that is vulnerable to a macro virus?

Question 80

What is a benign virus?