Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 701 > Malware > Flashcards

Malware Flashcards

1
Q

Malicious software designed to infiltrate computer systems and potentially damage them without user consent

A

Malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Method used to infiltrate a victim’s machine

Examples:
○ Unpatched software
○ USB drive installation
○ Phishing campaigns

A

Threat Vector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Means by which the attacker gains access and infects the system. Combines both infiltration method and infection process

A

Attack Vector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Viruses, Worms, Trojans, Ransomware, Zombies/Botnets, Rootkits, are examples of what?

A

Malware Attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Made up of malicious code that’s run on a machine without the user’s knowledge and this allows the code to infect the computer whenever it has been run

A

Computer Virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Attach to clean files, spread, and corrupt host files

A

Viruses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Type of malicious software that is designed to block access to a computer system or its data by encrypting it until a ransom is paid to the attacker

A

Ransomware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Compromised computers remotely controlled in a network for malicious purposes

A

Zombies and Botnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Hide presence and activities on a computer, operate at the OS level

A

Rootkits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Backdoors allow unauthorized access, logic bombs execute malicious
actions

A

Backdoors and Logic Bombs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Record keystrokes, capture passwords or sensitive information

A

Keyloggers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Spyware monitors and gathers user/system information, bloatware
consumes resources without value

A

Spyware and Bloatware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The following signs are indicators of what?
● Account lockouts
● Concurrent session utilization
● Blocked content
● Impossible travel
● Resource consumption
● Inaccessibility
● Out-of-cycle logging
● Missing logs
● Documented attacks

A

Malware Attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Virus that is stored in the first sector of a hard drive and is then loaded into memory whenever the computer boots up

A

Boot Sector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Form of code that allows a virus to be embedded inside another document so that when that document is opened by the user, the virus is executed.

A

Macro Virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Try to find executables or application files to infect with their malicious code

A

Program Virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Combination of a boot sector type virus and a program virus.

Able to place itself in the boot sector and be loaded every time the
computer boots

It can install itself in a program where it can be run every time the
computer starts up

A

Multiparite Virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Designed to hide itself from being detected by encrypting its malicious code or payloads to avoid detection by any antivirus software

A

Encrypted Virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Advanced version of an encrypted virus, but instead of just encrypting the contents it will actually change the viruses code each time it is executed by altering the decryption module in order for it to evade detection.

A

Polymorphic Virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Able to rewrite themselves entirely before it attempts to infect a given file

A

Metamorphic Virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Technique used to prevent the virus from being detected by the anti-virus software

A

Stealth Virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Have a layer of protection to confuse a program or a person who’s trying to analyze it

A

Armored Virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Form of technical social engineering that attempts to scare our end users into taking some kind of undesirable action on their system

A

Hoax Virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Piece of malicious software, much like a virus, but it can replicate itself without any user interaction

Able to self-replicate and spread throughout your network without a user’s consent or their action

Best known for spreading far and wide over the internet in a relative short amount of time

A

Worm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Piece of malicious software that is disguised as a piece of harmless or desirable software. Claims that it will perform some needed or desired function for you.

commonly used today by attackers to exploit a vulnerability in your
workstation and then conducting data exfiltration to steal your sensitive documents, creating backdoors to maintain persistence on your systems, and other malicious activities.

A

Trojans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Widely used by modern attackers because it provides the attacker with remote control of a victim machine

A

Remote Access Trojan (RAT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Network of compromised computers or devices controlled remotely by malicious actors

A

Botnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Name of a compromised computer or device that is part of a botnet. Used to perform tasks using remote commands from the attacker without the user’s knowledge

Attackers usually only use about 20-25% of any zombie’s power

A

Zombie

29
Q

Computer responsible for managing and coordinating the activities of other nodes or devices within a network

A

Command and Control Node

30
Q

______ are used

■ as pivot points
■ disguise the real attacker
■ to host illegal activities
■ to spam others by sending out phishing campaigns and other malware

used by attackers to combine processing power to break through different types of ecnryption schemes

A

Botnets

31
Q

Occurs when many machines target a single victim and attack them at the exact same time

A

Distributed Denial-of-Service (DDoS) Attack

32
Q

Designed to gain administrative level control over a given computer system without being detected.

it tries to move from Ring 1 to Ring 0 so that it
can hide from other functions of the operating system to avoid detection

closer the malicious code is to the kernel (ring 0), the more permissions
it will have and the more damage it can cause on your system

extremely powerful, and they are very difficult to detect because the
operating system is essentially blinded to them

A

Rootkit

33
Q

How can we protect ourselves and our organizations against ransomware?

A

■ Always conduct regular backups
■ Install software updates regularly
■ Provide security awareness training to your users
■ Implement Multi-Factor Authentication (MFA)

34
Q

What should you do if you find yourself or your organization as the victim of a ransomware attack?

A

Never pay the ransom
Disconnect infected system from the network
notify the authorities
restore the data from known good backups

35
Q

Where user level permissions are used

A

Ring 3 (Outermost Ring)

36
Q

Operating in ______ __ is called “kernel mode”

A

Ring 0 (Innermost or Higher Permission Level)

37
Q

Allows a system to control access to things like device drivers, your
sound card, your video display or monitor, and other similar things

A

Kernel Mode

38
Q

If you login as the administrator or root user on a system, you have root permission and you will be operating at ______ __ of the operating system

A

Ring 1

39
Q

Technique used to run arbitrary code within the address space of another process by forcing it to load a dynamic-link library

A

DLL Injection

40
Q

Collection of code and data that can be used by multiple programs
simultaneously to allow for code reuse and modularization in software development

A

Dynamic Link Library (DLL)

41
Q

Piece of software code that is placed between two components and that intercepts the calls between those components and can be used redirect them.

A

Shim

42
Q

Originally placed in computer programs to bypass the normal security and authentication functions

Most often put into systems by designers and programmers

(Remote Access Trojan is an example of this)

A

Backdoor

43
Q

a hidden feature or novelty within a program that is typically inserted by the software developers as an inside joke

Code often has significant vulnerabilities

A

Easter Egg

44
Q

Malicious code that’s inserted into a program, and the malicious code will only execute when certain conditions have been met

A

Logic Bombs

45
Q

Piece of software or hardware that records every single keystroke that is made on a computer or mobile device

can be either software-based or hardware-based

A

Keylogger

46
Q

Malicious programs that get installed on a victim’s computer

Often bundled with other software or delivered through social
engineering attacks, like phishing or pretexting attacks

A

Software Keyloggers

47
Q

Physical devices that need to be plugged into a computer

These will resemble a USB drive or they can be embedded within a
keyboard cable itself

A

Hardware Keyloggers

48
Q

■ Perform regular updates and patches
■ Rely on quality antivirus and antimalware solutions
■ Conduct phishing awareness training for your users
■ Implement multi-factor authentication systems
■ Encrypt keystrokes being sent to your systems
■ Perform physical checks of your desktops, laptops, and servers

A

Protects your organization from keyloggers

49
Q

Malicious software that is designed to gather and send information about a user or organization without their knowledge

A

Spyware

50
Q

Any software that comes pre-installed on a new computer or smartphone that you, as the user, did not specifically request, want, or need.

isn’t malicious, but it can
● waste your storage space
● slow down the performance of your devices
● introduce security vulnerabilities into your systems

A

Bloatware

51
Q

Specific method by which malware code penetrates and infects a targeted system.

A

Malware Exploitation Technique

52
Q

Piece of malware that is usually created as a lightweight shellcode
that can be executed on a given system

Primary function is to retrieve additional portions of the malware code and to trick the user into activating it.

A

Stage 1 Dropper or Downloader

53
Q

Specific malware type designed to initiate or run other malware
forms within a payload on an infected host

A

Dropper

54
Q

Retrieve additional tools post the initial infection facilitated by a
dropper

A

Downloader

55
Q

Broader term that encompasses lightweight code meant to
execute an exploit on a given target

A

Shellcode

56
Q

Downloads and installs a remote access Trojan to conduct
command and control on the victimized system

A

Stage 2: Downloader

57
Q

Threat actors will execute primary objectives to meet core
objectives like
■ data exfiltration
■ file encryption

A

“Actions on Objective” Phase

58
Q

Used to help the threat actor prolong unauthorized access to a
system by
■ hiding tracks
■ erasing log files
■ hiding any evidence of malicious activity

A

Concealment

59
Q

A strategy adopted by many Advanced Persistent Threats
and criminal organizations

The threat actors try to exploit the standard tools to
perform intrusions

A

“Living Off the Land”

60
Q

Malware, especially those designed for credential theft or brute force
attacks, can trigger multiple failed login attempts that would result in a user’s account being locked out

(Indicator of Malware Attack)

A

Account Lockouts

61
Q

If you notice that a single user account has multiple simultaneous or
concurrent sessions open, especially from various geographic locations

(Indicator of Malware Attack)

A

Concurrent Session Utilization

62
Q

If there is a sudden increase in the amount of blocked content alerts you are seeing from your security tools

(Indicator of Malware Attack)

A

Blocked Content

63
Q

Refers to a scenario where a user’s account is accessed from two or more geographically separated locations in an impossibly short period of time

(Indicator of Malware Attack)

A

Impossible Travel

64
Q

If you are observing any unusual spikes in CPU, memory, or network
bandwidth utilization that cannot be linked back to a legitimate task

(Indicator of Malware Attack)

A

Resource Consumption

65
Q

● Ransomware
● If a large number of files or critical systems suddenly become inaccessible
or if users receive messages demanding payment to decrypt their data

(Indicator of Malware Attack)

A

Resource Innacessability

66
Q

If you are noticing that your logs are being generated at odd hours or during times when no legitimate activities should be taking place (such as in the middle of the night when no employees are actively working)

(Indicator of Malware Attack)

A

Out-of-Cycle Logging

67
Q

If you are conducting a log review as a cybersecurity analyst and you see that there are gaps in your logs or if the logs have been cleared without any authorized reason

(Indicator of Malware Attack)

A

Missing Logs

68
Q

If a cybersecurity research or reporter published a report that shows that your organization’s network has been infected as part of a botnet or other malware-based attack

(Indicator of Malware Attack)

A

Published or Documented Attack

Security+ 701 (28 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions