Section 1.2 Potential indicators to determine the type of attack

Question 1

What type of viruses infect the boot sector or partition table of a disk?

Answer 1

Boot sector virus

Question 2

What is the best way to remove a boot sector virus from a system?

Answer 2

boot the system using an antivirus or similar emergency recovery data.

Question 3

What is the most common way a boot sector virus finds its way into a system?

Answer 3

through an infected disk or removable media device that is inserted into the computer.

Question 4

What kind of virus disguises itself as a legit program?

Answer 4

Companion virus

Question 5

What kind of virus generally infect the files that have the extension .com or .exe and try to replicate further by infecting other executable programs on the system with the same extension?

Answer 5

File Infector virus

Question 6

If your computer is afflicted with a file infector virus, you should not do what?

Answer 6

do not attach it to a network because it could start infecting files on other workstations and file servers

Question 7

What do you call an an instruction that carries out program commands automatically within an application?

Answer 7

Macro

Question 8

What kind of virus uses the internal workings of the application to perform malicious operations when a file containing the macros is opened?

Answer 8

Macro virus

Question 9

What kind of virus continues to stay in memory and infect other files that are run at the same time?

Answer 9

Memory-resident virus

Question 10

What kind of virus hides from antivirus software by encrypting it’s code?

Answer 10

Stealth Viruses

Question 11

What kind of viruses are designed to make detection and revers engineering difficult and time consuming, either through obfuscation or through techniques that add substantial amounts of confusing code to hide the actual virus code itself?

Answer 11

Armored Virus

Question 12

What kind of malware changes with each infection?

Answer 12

Polymorphic malware

Question 13

What kind of malware can recompile itself into a new form, and the code keeps changing from generation to generation?

Answer 13

Metamorphic malware

Question 14

What is the difference between polymorphic and metamorphic malware?

Answer 14

Metamorphic malware does not decrypt itself to a single constant virus body in memory

Question 15

What do you call a type of backdoor program that is inserted into application software and allows a remote user root access to the system on which the software is installed, without the permission or knowledge of the user?

Answer 15

Rootkit

Question 16

What kind of rootkit is embedded within the firmware of a device, such as a computer peripheral or network device?

Answer 16

Firmware rootkit

Question 17

What kind of rootkit is embedded within the operating system core itself?

Answer 17

Kernel rootkit

Question 18

What kind of rootkit is enabled when the system starts and will not turn off unless the system is shut down?

Answer 18

Persistent rootkit

Question 19

What kind of rootkit is activated and run in current system memory only when a specific application is launched and does not persist when the system is shut down and restored?

Answer 19

Application rootkit

Question 20

What kind of rootkit can intercept specific system and application programming interface (API) calls and replace them with its code?

Answer 20

Library rootkit

Question 21

In what kind of password attack does the attacker attempt to log in as a user by guessing the password?

Answer 21

Online password attack

Question 22

In what kind of password attack does the attacker steal the database of user credentials and loads them to a system where the attacker has a variety of tools to find the password?

Answer 22

Offline password attack

Question 23

What attack allows an attacker to authenticate as a user without having access to the user’s clear text password, bypassing standard authentication procedures that require a user to enter their credentials, and moving directly to the point where a hash is passed?

Answer 23

Pass the hash attack

Question 24

What kind of attack uses dictionaries, or lists of common words across various types of organizations, languages, and other words that might be used for passwords, as well as common substitutions?

Answer 24

Dictionary attack

Question 25

What kind of attacks are a variation on a dictionary attack that use precomputed hashes (rainbow tables) developed by software that can process huge lists of words and spit out their hash?

Answer 25

Rainbow attacks

Question 26

What kind of attack tries the most common passwords against many accounts?

Answer 26

Password spraying