SSCP Certification SSCP Malicious Code Countermeasures 5

Question 1

Which protocol is commonly abused for DNS tunneling by malware to exfiltrate data while bypassing firewall rules?

Accepted Answer

DNS (UDP 53)

Answer

DNS tunneling encodes data within DNS query and response packets on UDP port 53, which is typically allowed through firewalls, enabling covert data exfiltration or command-and-control communication.

Question 2

Which of the following is a characteristic of an advanced persistent threat (APT) that distinguishes it from common malware?

Accepted Answer

It involves long-term, stealthy intrusions aimed at a specific target

Answer

APTs are characterized by long-term, targeted campaigns where skilled adversaries maintain covert access to achieve strategic objectives such as espionage or intellectual property theft.

Question 3

A security team wants to detect malware that uses domain generation algorithms (DGA) for command-and-control. Which tool is MOST useful?

Accepted Answer

DNS query log analysis with anomaly detection

Answer

DGA malware generates large numbers of pseudo-random domain names; analyzing DNS query logs for high volumes of non-resolving or algorithmically generated domain requests reveals this behavior.

Question 4

What does the term 'blended threat' mean in the context of malicious code?

Accepted Answer

An attack combining multiple malware types or techniques to maximize damage

Answer

A blended threat combines characteristics of multiple malware types (e.g., virus propagation, Trojan payload, worm spreading) to exploit multiple vulnerabilities and increase attack effectiveness.

Question 5

Which email security control is MOST effective at preventing malware distribution via malicious attachments?

Accepted Answer

Scanning email attachments with an anti-malware gateway before delivery

Answer

An email security gateway that scans attachments for malware (including unknown threats via sandboxing) stops malicious files before they reach users' inboxes, regardless of encryption in transit.

SSCP Certification Practice Test

SSCP Certification Practice Test

SSCP Certification SSCP Malicious Code Countermeasures 5