SSCP Certification SSCP Malicious Code Countermeasures 4 — Questions and Answers
Question 1: Which of the following is a PRIMARY indicator of a fileless malware attack?
- Presence of multiple .exe files in the temp directory
- Malicious code executing entirely within memory without writing to disk (Correct answer)
- Large volumes of encrypted files appearing on the file system
- New user accounts created in Active Directory
Correct answer: Malicious code executing entirely within memory without writing to disk
Fileless malware operates entirely in memory (e.g., via PowerShell or WMI), leaving no files on disk and therefore evading traditional file-based antivirus detection.
Question 2: An attacker embeds a malicious macro in a Microsoft Word document sent via phishing email. Which countermeasure MOST directly prevents execution of this macro?
- Enabling full-disk encryption on employee workstations
- Configuring Group Policy to disable macros in Office applications (Correct answer)
- Deploying a network intrusion detection system
- Requiring multi-factor authentication for email login
Correct answer: Configuring Group Policy to disable macros in Office applications
Disabling macros via Group Policy prevents Office documents from executing embedded VBA code, directly blocking this common malware delivery vector.
Question 3: What is 'steganography' in the context of malware delivery?
- Encrypting malware with a symmetric key before distribution
- Hiding malicious code within an innocent-looking file such as an image (Correct answer)
- Obfuscating network traffic using VPN tunneling
- Using multiple layers of packers to compress malware
Correct answer: Hiding malicious code within an innocent-looking file such as an image
Steganography conceals malicious payloads within ordinary-looking files (images, audio, video) so that the carrier file appears benign to scanners and users.
Question 4: Which of the following BEST describes a multi-vector malware attack?
- Malware that targets multiple operating systems simultaneously
- An attack using several different infection methods to improve success rate (Correct answer)
- A virus that infects multiple files at once on a single host
- Ransomware that encrypts both files and the MBR
Correct answer: An attack using several different infection methods to improve success rate
Multi-vector attacks combine different delivery or exploitation techniques (e.g., phishing plus drive-by download plus USB drop) to increase the probability that at least one vector will succeed.
Question 5: A host-based intrusion prevention system (HIPS) blocks a process from injecting code into another running process. Which malware technique is being prevented?
- SQL injection
- Process hollowing or DLL injection (Correct answer)
- Cross-site scripting
- ARP spoofing
Correct answer: Process hollowing or DLL injection
Process hollowing and DLL injection are techniques where malware injects malicious code into a legitimate running process to hide its activity; HIPS can detect and block these abnormal process interactions.
Question 6: What is the MAIN purpose of indicator of compromise (IOC) sharing between organizations?
- To comply with data privacy regulations such as GDPR
- To enable rapid detection of known malware artifacts across the community (Correct answer)
- To allow organizations to prosecute attackers internationally
- To automate patch deployment across member organizations
Correct answer: To enable rapid detection of known malware artifacts across the community
IOC sharing (e.g., via STIX/TAXII or ISACs) allows organizations to distribute known malware hashes, IP addresses, and domains so others can detect and block the same threats more quickly.
Question 7: Which defense-in-depth practice is MOST effective at reducing the impact of a successful malware infection on a corporate network?
- Ensuring all endpoint passwords are at least 12 characters
- Segmenting the network so that infected hosts cannot reach all resources (Correct answer)
- Requiring security awareness training once per year
- Deploying a web application firewall on public-facing servers
Correct answer: Segmenting the network so that infected hosts cannot reach all resources
Network segmentation contains a malware infection to the compromised segment, limiting lateral movement and preventing the malware from reaching critical systems or sensitive data across the entire network.
SSCP Certification SSCP Malicious Code Countermeasures 4
Which of the following is a PRIMARY indicator of a fileless malware attack?