Chapter 50 · Quiz

Malicious Code Quiz

6 multiple-choice questions and a matching section. Submit to reveal answers and explanations.

Question 1 of 6

Which vulnerability did WannaCry ransomware exploit to spread autonomously across networks without any user interaction?

A. A cross-site scripting vulnerability in the Windows browser engine that executed the ransomware payload when users visited a malicious page B. A SQL injection flaw in the Windows authentication database that allowed the ransomware to bypass login requirements C. An arbitrary code execution vulnerability in Windows Server Message Block version 1 (SMBv1), catalogued as MS17-010, that allowed remote code execution on any reachable unpatched Windows system with no user action required D. A buffer overflow in the Windows DNS resolver triggered by a specially crafted DNS response when the system looked up a specific domain

Question 2 of 6

What made the British Airways cross-site scripting attack particularly efficient in terms of the ratio of attack effort to victim impact?

A. It required the attacker to compromise each of the 380,000 victims' individual devices to capture their payment data B. It required compromise of the payment card network's central clearing infrastructure, giving access to all transactions globally C. Only 22 lines of malicious JavaScript placed on the checkout pages of one website was sufficient to silently capture payment card data from approximately 380,000 customers as they completed normal transactions — one site compromise automatically became an attack on every visitor D. It used a self-propagating worm that spread automatically from the British Airways website to each customer's device, installing itself before transmitting payment data

Question 3 of 6

How does a worm fundamentally differ from a traditional virus in its propagation behavior?

A. A worm can only spread through email attachments; a virus can spread through any type of shared file or removable media B. A worm encrypts files on infected systems; a virus only replicates itself without affecting file contents C. A worm replicates and spreads autonomously across networks by exploiting vulnerabilities, requiring no host file and no user interaction; a virus attaches to existing files and requires a user to execute the infected file before it can spread further D. A worm targets only servers running network services; a virus targets only end-user workstations and personal computers

Question 4 of 6

Which type of malicious code disguises itself as a legitimate, useful application to trick users into installing it, while concealing its malicious payload — and does NOT self-replicate?

A. Worm — because worms are self-contained programs that masquerade as useful utilities to encourage installation B. Virus — because viruses attach to legitimate files and are therefore disguised within them C. Rootkit — because rootkits hide themselves within the operating system, disguising their presence from users D. Trojan horse — malicious code that appears to be legitimate, useful software; the user installs it voluntarily; it does not self-replicate and depends entirely on user installation for delivery

Question 5 of 6

What defense specifically and directly addresses the SMBv1 vulnerability used by WannaCry — and what does the WannaCry timeline reveal about the value of this defense?

A. Anti-malware with updated signatures — the WannaCry ransomware signature was already in databases when the attack occurred, so updated anti-malware would have blocked it on every system B. Firewall rules blocking all outbound HTTPS traffic — WannaCry used encrypted HTTPS for its command-and-control channel and was blocked where HTTPS egress filtering was in place C. Continuous patching — Microsoft released patch MS17-010 two months before the attack; every system that had applied it was completely immune; every infected system had failed to apply a patch that was already available, demonstrating that patching delays directly create the window for exploitation D. User awareness training — WannaCry required users to click a phishing link to initiate infection; training users to recognize phishing would have stopped it at the delivery stage

Question 6 of 6

What property of fileless malware makes it particularly difficult for traditional signature-based anti-malware tools to detect?

A. Fileless malware operates entirely in system memory without writing executable files to disk, so signature-based scanners that search the filesystem for malicious files find nothing to flag — the malware has no file-based signature to match B. Fileless malware runs at a lower privilege level than anti-malware processes, preventing the scanner from accessing the memory regions where the malicious code resides C. Fileless malware uses its own encryption keys to hide code from both memory and filesystem scanners while storing encrypted copies in disguised registry entries D. Fileless malware operates inside hardware firmware rather than the operating system, placing it below the layer where software-based anti-malware can inspect

Matching — Malicious Code Types

Match each term on the left to its correct description on the right.

1. Ransomware

2. Trojan Horse

3. SQL Injection

4. Cross-Site Scripting (XSS)

A. Malicious script injected into web page content that executes in other users' browsers; used to steal session cookies, credentials, or payment card data as users interact with the compromised site

B. Malicious code disguised as legitimate, useful software; user installs it voluntarily believing it is benign; hidden payload activates after installation; does not self-replicate

C. Malware that encrypts victim files and demands payment for the decryption key; delivery mechanism varies; defines its payload (extortion) rather than propagation method

D. Attack where malicious code is injected into database queries through unsanitized user input; allows unauthorized reading, modification, or deletion of database contents; prevented by parameterized queries

1 → 2 → 3 → 4 →