SSCP Certification SSCP Malicious Code Countermeasures 2

Question 1

Which technique do polymorphic viruses use to evade signature-based antivirus detection?

Accepted Answer

Encrypting the payload with a changing decryption routine

Answer

Hiding in the Master Boot Record

Answer

Injecting code into legitimate processes

Answer

Exploiting zero-day kernel vulnerabilities

Question 2

What is a 'logic bomb' in the context of malicious code?

Accepted Answer

Code that executes a malicious payload when a specific condition is met

Answer

Malware that spreads via email attachments

Answer

A rootkit that hides in the BIOS firmware

Answer

A worm that exploits network vulnerabilities automatically

Question 3

An organization suspects a rootkit infection. Which of the following is the MOST reliable remediation step?

Accepted Answer

Boot from trusted external media and reimage the system

Answer

Run a full antivirus scan from within the infected OS

Answer

Apply all pending OS patches and reboot

Answer

Disable all startup programs and monitor for reinfection

Question 4

Which countermeasure is MOST effective against spyware that monitors user keystrokes?

Accepted Answer

Host-based anti-malware with behavior monitoring

Answer

Network-based intrusion detection system

Answer

Perimeter firewall blocking outbound connections

Answer

Disabling USB ports

Question 5

A worm differs from a virus primarily because a worm:

Accepted Answer

Replicates itself across networks without needing a host file

Answer

Requires a human to execute an infected file to spread

Answer

Always encrypts target files for ransom

Answer

Requires administrator privileges to install

Question 6

Which of the following BEST describes a Trojan horse in information security?

Accepted Answer

Software that appears legitimate but contains hidden malicious functionality

Answer

Malware that self-replicates through network shares

Answer

A virus that targets the Master Boot Record

Answer

Ransomware that encrypts files and demands payment

Question 7

What is the purpose of application whitelisting as a malicious code countermeasure?

Accepted Answer

It allows only pre-approved applications to execute on a system

Answer

It encrypts all application data at rest

Answer

It scans executables against known malware signatures

Answer

It monitors network traffic for command-and-control communication