Skip to content

Module 07 — Malware Threats · Practice Questions

Original, concept-based questions written to teach the testable ideas — not exam dumps (those violate the EC-Council Candidate Agreement and get certs revoked). Answers are collapsed: think first, then expand. Aim for ≥80% before moving on. Log misses in PROGRESS.md.

Pairs with facts.md · flashcards.csv · README.md.

Q1. A piece of malware spreads from host to host across the network on its own, needing no host file and no user to run anything. What is it?

  • A. Worm
  • B. Virus
  • C. Trojan
  • D. Dropper
Answer **A. Worm.** A worm is standalone and self-propagates over the network with no user action — "worm = wire." A **virus** must attach to a host file and usually needs the user to run it; a **trojan** poses as legitimate software and needs the user to install it; a **dropper** is a delivery component, not a self-spreading class.

Q2. A downloaded utility installs the malware it was already carrying, writing it to disk. Which component performed this?

  • A. Downloader
  • B. Injector
  • C. Exploit
  • D. Dropper
Answer **D. Dropper.** A dropper *carries* the malware inside itself and writes it to disk. A **downloader** is different — it fetches later stages *from the internet*. The **exploit** gets code running; the **injector** loads code into another process. Swapping dropper and downloader is a classic trap.

Q3. Which virus type rewrites its own code entirely each generation, leaving no consistent static signature?

  • A. Encrypted virus
  • B. Polymorphic virus
  • C. Metamorphic virus
  • D. Cavity virus
Answer **C. Metamorphic virus.** It regenerates its actual instructions each time, so signature AV has nothing constant to match. A **polymorphic** virus only mutates its *encrypted body* (the decryptor changes but the underlying code is the same); an **encrypted** virus keeps a *constant* decryptor (weaker); a **cavity** virus hides in a file's slack space.

Q4. What is the key difference between a polymorphic and an encrypted virus?

  • A. Polymorphic changes its decryptor each time; encrypted keeps a constant decryptor
  • B. Polymorphic infects boot sectors; encrypted infects files
  • C. Polymorphic is fileless; encrypted is not
  • D. There is no difference
Answer **A.** Both encrypt their body, but a **polymorphic** virus mutates the *decryptor* every generation, so even the decryptor has no fixed signature. An **encrypted** virus reuses the *same* decryptor, which AV can fingerprint — making it weaker. Metamorphic goes further and rewrites the whole body.

Q5. Malware runs entirely in memory using powershell.exe and certutil.exe and never writes a malicious file to disk. This is best described as:

  • A. Boot-sector virus
  • B. Fileless / living-off-the-land (LOLBins)
  • C. Multipartite virus
  • D. Encrypted trojan
Answer **B. Fileless / LOLBins.** It abuses trusted, signed system binaries so nothing malicious touches disk, defeating *signature* AV. It does **not** evade *behavioral* detection — encoded PowerShell, rare parent-child, and a certutil download still light up EDR/Sysmon. Fileless ≠ harmless.

Q6. Why does fileless malware evade traditional signature-based antivirus, and what catches it instead?

  • A. It encrypts the disk; only backups catch it
  • B. It uses a zero-day, so only patching catches it
  • C. Nothing malicious is written to disk, so there is no file to signature — behavioral/EDR detection catches it
  • D. It runs as SYSTEM, so only firewalls catch it
Answer **C.** Signature AV scans *files*; fileless malware lives in memory via trusted binaries, so there's no on-disk artifact to match. The durable defense is **behavioral** — script-block logging (4104), rare LOLBin parent-child chains, and outbound beacons. It's the whole reason "living off the land" works.

Q7. An analyst hashes a suspicious binary, runs strings and dumps its PE imports without executing it. Which analysis type is this?

  • A. Dynamic analysis
  • B. Fuzzing
  • C. Sandbox detonation
  • D. Static analysis
Answer **D. Static analysis.** "Static = don't run it": hashing, `strings`, `file`, PE header/import inspection, and disassembly all examine the sample without execution. **Dynamic analysis** means running it in an isolated sandbox and watching behavior. Sandbox detonation is a form of dynamic analysis.

Q8. A rootkit loads a malicious kernel driver to hide processes from the OS. Which rootkit type is this, relative to a user-mode rootkit?

  • A. User-mode — easier for EDR to see
  • B. Kernel-mode — harder to detect than user-mode
  • C. Bootkit — infects the MBR
  • D. Hypervisor — runs the OS in a VM
Answer **B. Kernel-mode.** By loading a driver it runs at ring 0 and is harder to detect than a **user-mode** rootkit (which hooks user APIs and is more visible to EDR). A **bootkit** infects the bootloader/MBR/UEFI and loads before the OS; a **hypervisor** rootkit runs the real OS inside a rogue VM.

Q9. Which statement correctly separates a rootkit from a backdoor?

  • A. They are synonyms
  • B. Only rootkits are malware
  • C. A backdoor hides presence; a rootkit provides re-entry
  • D. A rootkit hides presence/privilege; a backdoor provides re-entry
Answer **D.** A **rootkit's** job is to *hide* the attacker's presence and privileged access; a **backdoor's** job is to *give re-entry*. A rootkit may *contain* a backdoor, but the terms are not interchangeable — confusing the two is a common exam trap.

Q10. An intrusion shows months of quiet activity: initial compromise, privilege escalation, lateral movement, and slow data exfiltration by a well-resourced actor. This best fits:

  • A. An Advanced Persistent Threat (APT)
  • B. A single opportunistic worm outbreak
  • C. A PUA/adware infection
  • D. A macro virus
Answer **A. APT.** An APT is defined by **stealth + persistence + a funded, goal-driven actor** moving through a lifecycle (recon → foothold → escalate → lateral → maintain → exfiltrate), not by any single tool or technique. A worm is noisy and self-spreading; PUA/adware and macro viruses aren't the described patient, targeted campaign.

Q11. You must analyze a live malware sample. What is the required safety setup for dynamic analysis?

  • A. Run it on your host with real-time AV enabled
  • B. An isolated, snapshotted VM with no (or fake) network
  • C. Your production server after hours
  • D. Any machine, as long as you have backups
Answer **B.** Dynamic analysis means *detonating* the sample, so it must run in an **isolated, snapshotted VM with no real network** (or a fake/controlled one). Real-time AV on your host doesn't make detonation safe, and never touch production. Snapshots let you revert; isolation prevents spread and C2 callout.

Q12. Which default port is historically associated with the Back Orifice trojan?

  • A. 443
  • B. 12345
  • C. 31337
  • D. 27374
Answer **C. 31337** ("eleet") is Back Orifice. **12345/12346** is NetBus, **27374** is Sub7. Note that modern C2 usually beacons over **443** precisely *because* it blends into normal HTTPS — a listening service on 31337 is a legacy tell, not today's norm.

Q13. For a PAM/EPM engineer, which single control most directly breaks the install-and-persist step that most droppers, rootkits, and ransomware depend on?

  • A. Longer user passwords
  • B. Removing standing local-admin rights + default-deny application control
  • C. Disabling IPv6
  • D. A faster antivirus signature feed
Answer **B.** Most droppers, rootkits, and ransomware need **privilege** to install and persist. Removing standing local admin (no standing rights) plus **default-deny app control (EPM/WDAC/AppLocker)** means the payload runs as a powerless user, if it runs at all. Password length and IPv6 don't address install/persist; signatures miss fileless and novel samples.

Q14. What is the best defense to make a ransomware encryptor's damage recoverable and limit its reach?

  • A. Real-time signature AV only
  • B. Enabling macros for trusted documents
  • C. Immutable/offline backups + JIT admin + network segmentation
  • D. Storing backups on the same file share
Answer **C.** **Immutable/offline backups** guarantee recovery even if online copies are encrypted; **JIT admin** means the encryptor rarely holds the standing rights to reach mass shares or delete shadow copies (`vssadmin delete`); **segmentation** limits blast radius. Backups on the same share get encrypted too; AV alone won't catch every variant.

Q15. A certutil.exe -urlcache -split -f http://... command appears in your logs, pulling a file from a remote host. Why is this a notable detection signal?

  • A. It is a trusted signed binary (LOLBin) being abused as a downloader — a behavioral IoC
  • B. certutil is malware and should be removed
  • C. It always means the host has a kernel rootkit
  • D. It only matters if AV flags the downloaded file
Answer **A.** `certutil` is a legitimate signed Windows binary, so signature AV won't flag it — but using it to fetch files over HTTP is classic **living-off-the-land**. The *behavior* (a signed cert utility acting as a downloader) is the indicator, which is why script/command-line logging and ASR rules matter more than file signatures here.

Score yourself

  • 13–15: solid — move on, revisit missed items in facts.md.
  • 10–12: re-read the virus types, malware components, and rootkit sections.
  • < 10: re-read README.md fully and redo the lab-walkthrough.md.