IS3340 CHAPTER 5 Flashcards
Software that intercepts all incoming (and optionally outgoing) information, scanning each message or file for malware content is called ___?
ANTI-MALWARE SHIELD
Software designed to detect and mitigate spyware is called ___?
ANTI-SPYWARE SOFTWARE
Software designed to detect and mitigate some types of malware, including mainly viruses, worms, and Trojan horses is called ___?
ANTIVIRUS SOFTWARE
A condition in which a running program stores data that is larger than the memory location set aside for the data is called ___?
The extra data spills spills over into adjacent memory, causing other data and possibly instructions to be overwritten. An attacker can place specific data in this area to change the instructions a program executes.
BUFFER OVERFLOW
The practice of identifying malware based on previous experience is called ___?
HEURISTICS
Software that is designed to infiltrate a target computer and make it do something the attacker has instructed it to do is called ___?
MALICIOUS SOFTWARE
A common term used to describe malicious software, including viruses, worms, and Trojan horses, especially in combinations is called ___?
MALWARE
Software that modifies or replaces one or more existing programs, often part of the operating system, to hide the fact a computer has been compromised is called a ___?
ROOTKIT
The unique set of instructions that make up an instance of malware and distinguish it from other malware is called ___?
SIGNATURE
An organized collection of malware signatures used by antivirus or anti-spyware (or other anti-malware) software to identify malware is called ___?
SIGNATURE DATABASE
Software that covertly monitors and records pieces of information such as Web surfing activities and all data process by the browser is called ___?
SPYWARE
Software that masquerades as an apparently harmless program or data file but contains malware instructions is called ___?
TROJAN HORSE
A software program that attaches itself to, or copies itself into, another program for the purpose of causing the computer to follow instructions that were not intended by the original program developer is called ___?
VIRUS
Active malware that either exploits an unknown vulnerability or one for which no fix has yet been released is called ___?
ZERO-DAY ATTACK
- Which type of malware is a standalone program that replicates and sends itself to other computers?
- Worm
- Virus
- Rootkit
- Trojan
Worm
- Which type of malware modifies or replaces parts of the operating system to hide the fact that the computer has been compromised?
- Worm
- Virus
- Rootkit
- Trojan
Rootkit
- Which type of malware disguises itself as a useful program?
- Worm
- Virus
- Rootkit
- Trojan
Trojan
- Which term describes a unique set of instructions that identify malware code?
- Fingerprint
- Signature
- Rule set
- Heuristic
Signature
- Which of the following terms means identifying the malware based on past experience?
- Heuristic analysis
- Log file analysis
- Signature analysis
- Historical analysis
Heuristic analysis
- A signature database that is one month old may potentially expose that computer to how many new threats?
- 200
- 1400
- 3000
- 6000
6000
- Which of the following terms describes a secure location to store identified malware?
- Safe
- Vault
- Signature database
- Secure Storage
Vault
- Which of the following anti-malware components is also referred to as a real-time scanner?
- Shield
- Scanner
- Heuristic engine
- Antivirus software
Shield
- Which anti-malware tool is included with Windows 7?
- Windows AntiVirus
- Windows Doctor
- Windows Defender
- Windows Sweeper
Windows Defender
- Which of the following best describes a zero-day attack?
- Malware that no longer is a threat
- Malware that can exploit a vulnerability but has not yet been released
- Malware that is actively exploiting vulnerabilities on computers that have not applied the latest patches
- Malware that is actively exploiting an unknown vulnerability
Malware that is actively exploiting an unknown vulnerability
- What is the best first step to take when malware is discovered soon after installing new software?
- Uninstall the new software
- Scan for malware
- Update the new software
- Install additional anti-malware software
Uninstall the new software
- What is the best first step to take if initial actions to remove malware are not successful?
- Install additional anti-malware software
- Rescan for malware
- Update the signature database
- Disconnect the computer from the network
Disconnect the computer from the network
- The Morris worm exploited this vulnerability:
____?
Buffer overflow
- Which type of malware covertly primarily collects pieces of information?
- Spyware
- Trojan
- Virus
- Rootkit
Spyware
- Why is a rootkit so difficult to detect?
- Most anti-malware tools don’t scan for rootkits
- A rootkit gives administrator privileges to an attacker
- A rootkit does not run in memory
- A rootkit may have modified the tools used to detect it
A rootkit may have modified the tools used to detect it
