Chapter 43 · Quiz

Other Malware Types Quiz

Seven questions covering keyloggers, encryption bypass, logic bombs, SCADA attacks, and rootkit detection.

Q1. A user's banking credentials were stolen. The user's workstation has HTTPS enforced for all banking sessions, current antivirus with up-to-date signatures, and full-disk encryption enabled. The antivirus scan returned clean. Which explanation is MOST consistent with all of these facts?

A. The attacker compromised the bank's HTTPS certificate to intercept the encrypted session B. The full-disk encryption was not properly configured and the attacker read the credential file from disk C. A keylogger captured the credentials at the moment of typing, before the browser applied encryption D. The antivirus definition database was outdated despite showing as current

Q2. A security researcher demonstrates DarkComet RAT's keylogging module in a controlled environment. She types "passw", then presses Backspace twice, then types "sword1!". What does DarkComet's log capture?

A. Only the final string "password1!" because that is what was submitted to the application B. The complete sequence: "passw", two Backspace key presses, then "sword1!" — preserving every keystroke including corrections C. Only keystrokes sent to encrypted fields — Notepad input is excluded from keylogger capture D. The clipboard contents only, because DarkComet uses clipboard monitoring rather than direct keystroke capture

Q3. An analyst discovers that a scheduled maintenance script was modified to include a section that will delete production database records when executed on a specific future date. The modification was made by a recently terminated database administrator before their departure. The antivirus scan of the script file returns clean. Which control would MOST likely detect this before the date arrives?

A. Updated antivirus signatures — the script will be detected once the vendor classifies it B. File integrity monitoring (FIM) — it would have alerted when the script was modified, before the trigger date C. Network-based IDS — it would detect the unusual database query pattern when the bomb fires D. Full-disk encryption — it would prevent unauthorized changes to script files

Q4. In the South Korea cyberattack of March 2013, thousands of systems at banks and broadcasting companies simultaneously displayed "Boot device not found" at 2:00 PM on March 20. A phishing email on March 19 was the initial vector. Which malware technique produced this coordinated simultaneous outcome?

A. A worm that propagated rapidly between systems and deleted the MBR on each system it reached B. A rootkit that triggered its destructive payload when the system administrator logged in at shift start C. A time-based logic bomb pre-programmed to fire at 2:00 PM March 20, which deleted storage and the MBR and then triggered a reboot on every infected system simultaneously D. Ransomware that encrypted the MBR and required payment before the operating system could be restored

Q5. A security analyst opens Task Manager on a workstation and sees no suspicious processes. A full antivirus scan returns clean. However, the perimeter firewall logs show regular outbound connections from that workstation to an unrecognized external IP address at 3:00 AM. Which explanation BEST accounts for the discrepancy between the clean local scan and the anomalous firewall logs?

A. The malware is a user-space process that runs only at 3:00 AM and exits before the analyst's scan begins B. The antivirus needs updated signatures — the malware will be detected after the next signature update C. A kernel-level rootkit is intercepting OS queries and removing itself from the process list and file scan results, while the firewall's external monitoring — which does not query the compromised OS — shows the actual traffic D. The firewall is logging DNS lookups from a browser cached page, generating false positive connection alerts

Q6. Which technology is the PRIMARY hardware-level prevention mechanism against rootkits that modify the OS kernel?

A. Full-disk encryption (BitLocker) — prevents unauthorized modification of OS files stored on disk B. Secure Boot (UEFI) — verifies the digital signatures of OS components before loading them; a modified kernel fails the signature check and is not loaded C. Behavioral anti-malware — detects rootkit behavior through anomaly analysis during runtime D. Network segmentation — limits the rootkit's ability to communicate with attacker infrastructure

Q7. Match each term on the left to its correct description on the right.

Click each term on the left, then click its match on the right.

Match each item on the left with its correct description on the right:

Logic Bomb

Rootkit

Keylogger

SCADA

A. Embeds in the OS kernel; hides from Task Manager and antivirus by intercepting and falsifying OS query responses

B. Industrial control system technology for physical infrastructure (power grids, water treatment); targeted in the Ukraine 2016 cyberattack

C. Dormant until a trigger fires; custom-written so no AV signature exists; often planted by insiders

D. Captures keystrokes before encryption is applied; bypasses HTTPS and full-disk encryption; may also capture clipboard, screenshots, and search queries

Click an item on the left to select it, then click its match on the right.