Chapter 40 · Quiz

Malware Overview Quiz

Seven questions covering malware types, infection vectors, ransomware behavior, and foundational defenses.

Q1. Which of the following BEST defines the term "malware"?

A. Any software that slows down a computer system's performance B. Any program or code designed to damage, disrupt, spy on, or gain unauthorized access to a system C. Software that is installed without administrator approval D. A type of virus that spreads via email attachments

Q2. A user's workstation has been infected with ransomware. The user reports that they can still browse the internet and use applications, but all of their work documents have unfamiliar file extensions and cannot be opened. Which of the following BEST explains why the operating system remains functional?

A. The ransomware encountered an error and only partially executed B. Ransomware is designed to encrypt data files while leaving the OS functional so the victim can read the ransom demand and pay C. The antivirus blocked the OS encryption but not the data encryption D. The OS files are stored on a separate partition that ransomware cannot access

Q3. A security analyst discovers that a malware infection on a workstation began while the user was visiting a legitimate industry news website. The user did not click any links or download any files. Which infection vector BEST explains this incident?

A. Worm propagation via a network vulnerability B. A Trojan horse disguised as browser software C. A drive-by download exploiting an unpatched browser vulnerability D. A logic bomb triggered by visiting a specific URL

Q4. An organization's security team discovers that a ransomware infection began with a worm that exploited an unpatched network vulnerability, established a remote access backdoor on multiple systems, ran a keylogger for four days, and then deployed ransomware across all compromised hosts simultaneously. Which of the following BEST describes this type of attack?

A. A single-vector ransomware attack using social engineering B. A logic bomb attack with a delayed ransomware payload C. A multi-stage attack combining worm, backdoor, keylogger, and ransomware in a coordinated chain D. A botnet attack using distributed denial of service techniques

Q5. An organization's files have been encrypted by ransomware. Which of the following represents the MOST effective recovery strategy?

A. Pay the ransom — this guarantees recovery of the decryption key B. Run antivirus software to reverse the encryption C. Restore from a recent offline backup taken before the infection D. Contact the software vendor for a free decryption tool

Q6. Why is it important to keep antivirus signature files current on a daily basis?

A. Signature updates improve the antivirus software's scan speed and performance B. New malware variants are released constantly; outdated signatures cannot detect threats that appeared after the last update C. Antivirus requires daily updates to maintain its software license D. Signature updates allow antivirus to detect zero-day malware before it is discovered

Q7. Match each malware type to its defining characteristic.

Click each term on the left, then click its match on the right.

Match each item on the left with its correct characteristic on the right:

Logic Bomb

Rootkit

Trojan Horse

Keylogger

A. Records every keystroke and transmits credentials to the attacker

B. Disguised as legitimate software; executes malicious payload when the user installs it

C. Dormant code that triggers on a specific condition such as a date or deleted account

D. Gains administrator-level control while hiding its presence from the OS and security tools

Click an item on the left to select it, then click its match on the right.