Certified Ethical Hacker System Hacking and Malware 3 — Questions and Answers
Question 1: A Trojan opens TCP port 6667 and beacons to an external server awaiting commands. This indicates the host is part of what?
- A honeypot
- A botnet (Correct answer)
- A DMZ
- A VPN tunnel
Correct answer: A botnet
A compromised host beaconing to a command server for instructions is a bot in a botnet.
Question 2: Which type of malware encrypts a victim's files and demands payment for the decryption key?
- Spyware
- Ransomware (Correct answer)
- Adware
- Rootkit
Correct answer: Ransomware
Ransomware encrypts files and demands payment for the decryption key.
Question 3: An ethical hacker wants to detect a previously unknown malware sample by observing its runtime behavior in an isolated environment. This is called what?
- Static analysis
- Signature scanning
- Dynamic (sandbox) analysis (Correct answer)
- Hash comparison
Correct answer: Dynamic (sandbox) analysis
Dynamic analysis runs the sample in a sandbox to observe its behavior at runtime.
Question 4: Which tool is commonly used to bind a Trojan to a legitimate executable so it runs alongside the original program?
- Wrapper (binder) (Correct answer)
- Port scanner
- Packet sniffer
- Disassembler
Correct answer: Wrapper (binder)
A wrapper or binder joins a Trojan to a legitimate executable so both run together.
Question 5: An attacker schedules malicious code to execute only when a specific employee's account is deleted. This is an example of what?
- Worm
- Logic bomb (Correct answer)
- Keylogger
- Backdoor
Correct answer: Logic bomb
A logic bomb executes its payload when a specific condition or trigger is met.
Question 6: Which Windows feature, when abused, lets attackers store malicious data hidden from normal directory listings on NTFS volumes?
- Alternate Data Streams (ADS) (Correct answer)
- Shadow copies
- Page file
- Registry hives
Correct answer: Alternate Data Streams (ADS)
NTFS Alternate Data Streams can hide data that does not appear in standard directory listings.
Question 7: What is the primary purpose of a packer when used by malware authors?
- To speed up program execution
- To compress and obfuscate the binary to evade signature detection (Correct answer)
- To add legitimate digital signatures
- To improve memory management
Correct answer: To compress and obfuscate the binary to evade signature detection
Packers compress and obfuscate malware binaries to evade signature-based detection.
Certified Ethical Hacker System Hacking and Malware 3
A Trojan opens TCP port 6667 and beacons to an external server awaiting commands.
This indicates the host is part of what?