SSCP Certification SSCP Malicious Code Countermeasures 3 — Questions and Answers
Question 1: Which type of malware is specifically designed to encrypt a victim's files and demand payment for the decryption key?
- Spyware
- Adware
- Ransomware (Correct answer)
- Backdoor
Correct answer: Ransomware
Ransomware encrypts victim data and withholds the decryption key until a ransom is paid, making data inaccessible until either payment is made or backups are restored.
Question 2: A security analyst observes that malware on a compromised host is communicating with an external IP on port 443 using HTTPS. What technique is MOST likely being used?
- DNS tunneling
- Command-and-control over encrypted web traffic (Correct answer)
- ARP poisoning
- Pass-the-hash attack
Correct answer: Command-and-control over encrypted web traffic
Using port 443 with HTTPS allows malware to blend command-and-control traffic with normal web traffic, making it harder for network monitoring tools to detect or block.
Question 3: Which scanning technique improves detection of malware that hides within compressed or packed executables?
- Signature-based scanning only
- Heuristic or emulation-based scanning (Correct answer)
- Network traffic analysis
- File integrity monitoring
Correct answer: Heuristic or emulation-based scanning
Heuristic and emulation-based scanners unpack or emulate compressed executables to analyze their behavior, allowing detection of malware that signature scanners would miss in packed form.
Question 4: What is the PRIMARY security benefit of maintaining offline, air-gapped backups in the context of ransomware defense?
- They prevent ransomware from executing on endpoints
- They ensure data can be restored without paying the ransom (Correct answer)
- They detect ransomware activity through anomaly detection
- They block lateral movement by isolating network segments
Correct answer: They ensure data can be restored without paying the ransom
Offline backups that ransomware cannot reach allow an organization to restore encrypted data without paying the attacker, making the attack far less impactful.
Question 5: A metamorphic virus differs from a polymorphic virus in that a metamorphic virus:
- Uses encryption to hide its payload
- Completely rewrites its own code with each infection (Correct answer)
- Only targets Windows operating systems
- Requires a host file to propagate
Correct answer: Completely rewrites its own code with each infection
Metamorphic viruses rewrite their entire code structure — including logic and instructions — with each generation, making them far harder to detect than polymorphic viruses that only change their decryption stub.
Question 6: Which of the following BEST describes a botnet in the context of malicious code?
- A single compromised server used to store stolen credentials
- A network of infected computers remotely controlled by an attacker (Correct answer)
- Malware that destroys hardware by overwriting firmware
- Spyware that records and transmits browser history
Correct answer: A network of infected computers remotely controlled by an attacker
A botnet is a collection of malware-infected hosts (bots) that are centrally controlled by a command-and-control server to perform coordinated malicious activities such as DDoS attacks or spam campaigns.
Question 7: What role does sandboxing play in a malware analysis environment?
- It permanently removes malware from production systems
- It provides an isolated environment to safely execute and observe malicious code (Correct answer)
- It encrypts suspicious files to prevent them from running
- It patches known vulnerabilities before malware can exploit them
Correct answer: It provides an isolated environment to safely execute and observe malicious code
A sandbox runs suspected malware in an isolated, monitored environment where its behavior can be observed without risk of infecting the production system.
SSCP Certification SSCP Malicious Code Countermeasures 3
Which type of malware is specifically designed to encrypt a victim's files and demand payment for the decryption key?