What is the main difference between a Virus and a Worm?
Virus: Requires a host file (e.g., an .exe or a document) and human interaction (e.g., opening the file) to spread.
Worm: Is self-replicating and spreads automatically across a network, often by exploiting vulnerabilities. It does not need a host file or human help.
What is the term for a virus that mutates its code with each new infection? This is done specifically to ensure that its hash value (or signature) is different every time, allowing it to evade simple signature-based detection.
Polymorphic virus
Q: A user calls the help desk, reporting that a large pop-up window has taken over their screen. The window, which looks like a system utility, is flashing red and warning that “128 viruses and 47 exploits” have been found. It is demanding a one-time $49.95 payment to “purchase the full security suite” and clean the computer.
What type of malware BEST describes this attack?
A. Adware
B. Scareware
C. Ransomware
D. Spyware
B. Scareware
Explanation: This is a classic example of scareware. It uses deception and social engineering (frightening pop-ups, fake scan results) to trick a user into paying for a fake or malicious “service.” It preys on the user’s fear.
It is not ransomware because the user’s files are not encrypted; they are just being tricked, not extorted.
It is not adware, which typically just displays unwanted (but not necessarily fake) advertisements.
What is UPnP, what ports does it use, and what is its security risk?
Universal Plug and Play
Ports UDP/1900 for discovery, TCP/5000 for accepting incoming connections from other UPnP devices.
UPnP is a protocol that allows devices on a network to automatically discover each other and configure network settings (like opening ports).
Risk: It’s a major security flaw. Malware (especially worms) can exploit it to bypass the firewall and open ports for remote access
A user downloads what they believe is a free “video codec” to watch a movie. After running the installer, their computer seems to work normally, but in the background, the program has installed a hidden tool that gives an attacker complete remote control of their system.
What type of malware BEST describes this?
RAT (Remote Access Trojan)
What is the term for a type of malware designed to gain the highest level of privilege (root/administrator) and use its deep system access to hide itself and its malicious activity from the operating system and security software?
This malware can infect the OS kernel, the bootloader (a bootkit), or even the hardware firmware.
Rootkit
A user reports their mouse and keyboard are acting “flaky.” A technician investigates and finds an unknown USB dongle plugged in between the keyboard cable and the desktop’s USB port.
What is this malicious device MOST LIKELY?
Hardware Keylogger
Adware
uses popups
Bots
infected machine used as an attack vector
A user calls the help desk in a panic because their “mouse is moving on its own” and closing windows. The technician disconnects the network cable immediately. Later analysis shows a malware infection that established a reverse connection to an external IP, allowing the attacker to interactively control the desktop.
What specific type of malware is this?
RAT (Remote Access Trojan)
Explanation:
* Spyware/Keyloggers are passive; they hide and steal data silently.
* RATs are active; they provide a Command and Control (C2) channel that gives the attacker interactive remote control over the system. The “ghost in the machine” symptom (mouse moving) is the classic giveaway of a RAT.
Logic bomb
needs a trigger, such as time
Phishing
uses email; targets one person
Spear phishing
attacks a group; look for plurals in the question
Whaling
attacks CEO or high‐level executives
Vishing
uses a telephone or leaves a voicemail
Tailgating
follows someone through; does not use credentials
Impersonating
pretends to be from the help desk or IT team
Dumpster diving
pulls information from the trash bin
Shoulder surfing
someone looks over an employee’s shoulder or uses a smartphone to video your bank transaction
Watering hole
infects a trusted website
Authority
email from CEO or HR; asks you to fill in a form
Urgency
letting a fireman into the server room
DoS
one host taking out another
DDoS
multiple hosts taking out one host
-
Categories & Types of security controls50
-
Chapter 1 - Types of security controls11
-
Threats, Attacks, and Vulnerabilities60
-
Threats, Attacks, and Vulnerabilities 250
-
Threats, Attacks, and Vulnerabilities 325
-
Mock Exam151
-
Cheat Sheet80
-
Chapter 2: Technologies and Tools Practice Tests50
-
Chapter 2: Technologies and Tools20
-
Chap2: Technologies and Tools 224
-
Mock Exam 249
-
Chap3 - Architecture and Design52
-
Chapter 3: Architecture and Design265
-
Mock Exam 350
-
Chapter 4: Identity and Access Management55
-
Monitoring and Incident Response20
