SSCP Certification SSCP Malicious Code Countermeasures 5 — Questions and Answers
Question 1: Which protocol is commonly abused for DNS tunneling by malware to exfiltrate data while bypassing firewall rules?
- ICMP
- DNS (UDP 53) (Correct answer)
- SNMP
- LDAP
Correct answer: DNS (UDP 53)
DNS tunneling encodes data within DNS query and response packets on UDP port 53, which is typically allowed through firewalls, enabling covert data exfiltration or command-and-control communication.
Question 2: Which of the following is a characteristic of an advanced persistent threat (APT) that distinguishes it from common malware?
- It spreads automatically without human interaction
- It targets systems for short-duration, opportunistic financial gain
- It involves long-term, stealthy intrusions aimed at a specific target (Correct answer)
- It relies exclusively on known vulnerabilities with published CVEs
Correct answer: It involves long-term, stealthy intrusions aimed at a specific target
APTs are characterized by long-term, targeted campaigns where skilled adversaries maintain covert access to achieve strategic objectives such as espionage or intellectual property theft.
Question 3: A security team wants to detect malware that uses domain generation algorithms (DGA) for command-and-control. Which tool is MOST useful?
- File integrity monitoring software
- DNS query log analysis with anomaly detection (Correct answer)
- Full-packet network capture at the perimeter firewall
- Host-based vulnerability scanner
Correct answer: DNS query log analysis with anomaly detection
DGA malware generates large numbers of pseudo-random domain names; analyzing DNS query logs for high volumes of non-resolving or algorithmically generated domain requests reveals this behavior.
Question 4: What does the term 'blended threat' mean in the context of malicious code?
- Malware that targets both Windows and Linux systems
- An attack combining multiple malware types or techniques to maximize damage (Correct answer)
- A rootkit hidden inside legitimate software updates
- A Trojan that also functions as a keylogger
Correct answer: An attack combining multiple malware types or techniques to maximize damage
A blended threat combines characteristics of multiple malware types (e.g., virus propagation, Trojan payload, worm spreading) to exploit multiple vulnerabilities and increase attack effectiveness.
Question 5: Which email security control is MOST effective at preventing malware distribution via malicious attachments?
- Encrypting all email in transit with TLS
- Scanning email attachments with an anti-malware gateway before delivery (Correct answer)
- Requiring S/MIME signatures on all outbound email
- Implementing DMARC to prevent spoofing of the organization's domain
Correct answer: Scanning email attachments with an anti-malware gateway before delivery
An email security gateway that scans attachments for malware (including unknown threats via sandboxing) stops malicious files before they reach users' inboxes, regardless of encryption in transit.
Question 6: What is the MAIN risk of using outdated or unpatched antivirus signature definitions?
- Increased CPU usage from scanning processes
- Failure to detect newly released malware variants (Correct answer)
- Incompatibility with the host operating system
- Higher false-positive rates during scheduled scans
Correct answer: Failure to detect newly released malware variants
Antivirus solutions that rely on signature databases cannot detect malware whose signatures are newer than the last update, leaving systems vulnerable to the latest threats.
Question 7: Which of the following countermeasures addresses the threat of malware delivered through drive-by downloads on malicious websites?
- Enforcing strong password policies for all user accounts
- Deploying a web content filtering proxy to block known malicious URLs (Correct answer)
- Enabling host-based firewalls on all servers
- Requiring VPN use for all remote connections
Correct answer: Deploying a web content filtering proxy to block known malicious URLs
A web content filtering proxy inspects and blocks user requests to known malicious or uncategorized sites, preventing browsers from reaching pages that would silently download and execute malware.
SSCP Certification SSCP Malicious Code Countermeasures 5
Which protocol is commonly abused for DNS tunneling by malware to exfiltrate data while bypassing firewall rules?