SSCP Certification SSCP Malicious Code Countermeasures 2

Question 1

Which technique do polymorphic viruses use to evade signature-based antivirus detection?

Accepted Answer

Encrypting the payload with a changing decryption routine

Answer

Polymorphic viruses mutate their decryption routine with each infection, causing their binary signature to change so static signature scanners cannot match known patterns.

Question 2

What is a 'logic bomb' in the context of malicious code?

Accepted Answer

Code that executes a malicious payload when a specific condition is met

Answer

A logic bomb is dormant code embedded in a legitimate program that triggers a destructive action only when predefined conditions (e.g., a date or user action) occur.

Question 3

An organization suspects a rootkit infection. Which of the following is the MOST reliable remediation step?

Accepted Answer

Boot from trusted external media and reimage the system

Answer

Because rootkits can subvert the infected OS and hide from tools running within it, booting from trusted external media and reimaging is the most reliable way to ensure complete removal.

Question 4

Which countermeasure is MOST effective against spyware that monitors user keystrokes?

Accepted Answer

Host-based anti-malware with behavior monitoring

Answer

Host-based anti-malware with behavioral analysis can detect anomalous hooking of keyboard APIs indicative of keyloggers, regardless of whether the code has a known signature.

Question 5

A worm differs from a virus primarily because a worm:

Accepted Answer

Replicates itself across networks without needing a host file

Answer

Unlike viruses, worms are self-contained programs that propagate autonomously across networks by exploiting vulnerabilities, without needing to attach to or infect an existing file.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Malicious Code Countermeasures 2