Chapter 41 · Quiz

Viruses and Worms Quiz

Seven questions covering the virus/worm distinction, the four virus types, fileless malware, and worm containment controls.

Q1. Which of the following BEST describes the fundamental difference between a virus and a worm?

A. Viruses encrypt data; worms do not B. Viruses require user interaction to spread; worms self-propagate across networks without user action C. Viruses target executables; worms target documents D. Viruses spread via the network; worms spread via email only

Q2. A technician discovers that a USB drive, when connected to a computer and used to boot, infects the computer even before Windows loads. Which virus type BEST describes this behavior?

A. Script virus B. Boot sector virus C. Macro virus D. Program virus

Q3. A security analyst investigates suspicious behavior on a workstation. The antivirus scan returns clean and no malicious files are found on disk. However, an EDR tool alerts on PowerShell making outbound connections at startup, and the analyst finds an unusual registry Run key containing a PowerShell command. Which type of malware BEST explains these findings?

A. A program virus embedded in a Windows system executable B. A macro virus in a document accessed at startup C. A fileless virus operating in memory with a registry-based persistence mechanism D. A boot sector virus that modifies registry values during boot

Q4. Why does a fileless virus evade detection by traditional signature-based antivirus software?

A. Fileless viruses use strong encryption that antivirus cannot break B. Antivirus scans files on disk, but fileless viruses operate in memory without writing malicious files to storage C. Fileless viruses modify antivirus signature databases to exclude their own signatures D. Antivirus cannot scan memory under any circumstances

Q5. The WannaCry attack in 2017 combined two malware capabilities. Which combination BEST describes WannaCry?

A. A Trojan horse that delivered a keylogger payload B. A macro virus that spread via Microsoft Office documents C. A worm that used EternalBlue to self-propagate and delivered ransomware as its payload D. A fileless virus that operated through PowerShell and encrypted files in memory

Q6. A worm has been detected on a single server in a data center. The server cannot be immediately taken offline. Which of the following is the MOST effective immediate action to prevent the worm from spreading to other systems?

A. Run a full antivirus scan on the infected server and quarantine detected files B. Change all user passwords on the affected server C. Isolate the server at the network layer using VLAN segmentation or ACLs to block its ability to reach other systems D. Disable all USB ports on other servers to prevent the worm from spreading via removable media

Q7. Match each virus type to its defining characteristic.

Click each term on the left, then click its match on the right.

Match each item on the left with its correct characteristic on the right:

Boot Sector Virus

Macro Virus

Script Virus

Program Virus

A. Executes at system startup before the OS loads; infects storage device boot sectors

B. Attaches to executable files; spreads by injecting code into other executables when the infected program runs

C. Embedded in Word, Excel, or PowerPoint files; executes when the document is opened and macros run

D. Written in JavaScript, VBScript, or PowerShell; executes via browser or OS scripting engine

Click an item on the left to select it, then click its match on the right.