SSCP Certification SSCP Malicious Code Countermeasures 2 — Questions and Answers
Question 1: Which technique do polymorphic viruses use to evade signature-based antivirus detection?
- Encrypting the payload with a changing decryption routine (Correct answer)
- Hiding in the Master Boot Record
- Injecting code into legitimate processes
- Exploiting zero-day kernel vulnerabilities
Correct answer: Encrypting the payload with a changing decryption routine
Polymorphic viruses mutate their decryption routine with each infection, causing their binary signature to change so static signature scanners cannot match known patterns.
Question 2: What is a 'logic bomb' in the context of malicious code?
- Malware that spreads via email attachments
- Code that executes a malicious payload when a specific condition is met (Correct answer)
- A rootkit that hides in the BIOS firmware
- A worm that exploits network vulnerabilities automatically
Correct answer: Code that executes a malicious payload when a specific condition is met
A logic bomb is dormant code embedded in a legitimate program that triggers a destructive action only when predefined conditions (e.g., a date or user action) occur.
Question 3: An organization suspects a rootkit infection. Which of the following is the MOST reliable remediation step?
- Run a full antivirus scan from within the infected OS
- Apply all pending OS patches and reboot
- Boot from trusted external media and reimage the system (Correct answer)
- Disable all startup programs and monitor for reinfection
Correct answer: Boot from trusted external media and reimage the system
Because rootkits can subvert the infected OS and hide from tools running within it, booting from trusted external media and reimaging is the most reliable way to ensure complete removal.
Question 4: Which countermeasure is MOST effective against spyware that monitors user keystrokes?
- Network-based intrusion detection system
- Host-based anti-malware with behavior monitoring (Correct answer)
- Perimeter firewall blocking outbound connections
- Disabling USB ports
Correct answer: Host-based anti-malware with behavior monitoring
Host-based anti-malware with behavioral analysis can detect anomalous hooking of keyboard APIs indicative of keyloggers, regardless of whether the code has a known signature.
Question 5: A worm differs from a virus primarily because a worm:
- Requires a human to execute an infected file to spread
- Replicates itself across networks without needing a host file (Correct answer)
- Always encrypts target files for ransom
- Requires administrator privileges to install
Correct answer: Replicates itself across networks without needing a host file
Unlike viruses, worms are self-contained programs that propagate autonomously across networks by exploiting vulnerabilities, without needing to attach to or infect an existing file.
Question 6: Which of the following BEST describes a Trojan horse in information security?
- Malware that self-replicates through network shares
- Software that appears legitimate but contains hidden malicious functionality (Correct answer)
- A virus that targets the Master Boot Record
- Ransomware that encrypts files and demands payment
Correct answer: Software that appears legitimate but contains hidden malicious functionality
A Trojan horse disguises itself as benign or useful software while secretly performing unauthorized malicious actions such as creating backdoors or exfiltrating data.
Question 7: What is the purpose of application whitelisting as a malicious code countermeasure?
- It encrypts all application data at rest
- It allows only pre-approved applications to execute on a system (Correct answer)
- It scans executables against known malware signatures
- It monitors network traffic for command-and-control communication
Correct answer: It allows only pre-approved applications to execute on a system
Application whitelisting prevents unauthorized or unknown executables from running by enforcing a policy that only explicitly approved programs are allowed to execute.
SSCP Certification SSCP Malicious Code Countermeasures 2
Which technique do polymorphic viruses use to evade signature-based antivirus detection?