Name:
Class:
Date:
Page 1
1. Malware is malicious software, such as a virus, worm, or Trojan program, introduced
into a network.
a.
True
b.
False
ANSWER:
True
2. Malware programs cannot be detected by antivirus programs.
a.
True
b.
False
ANSWER:
False
3. Whitelisting allows only approved programs to run on a computer.
a.
True
b.
False
ANSWER:
True
4. In a buffer overflow attack, an attacker finds a vulnerability in poorly written code that doesn’t check for a
defined amount of memory space use.
a.
True
b.
False
ANSWER:
True
5. A DDoS attack is launched against a host from a single server or workstation.
a.
True
b.
False
ANSWER:
False
6. What type of malicious program cannot stand on its own and can replicate itself through an executable
program attached to an e-mail?
a.
shell
b.
virus
c.
keylogger
d.
rootkit
ANSWER:
b
7. The virus signature file is maintained by what type of software?
a.
antivirus
b.
keylogger
c.
remote control
d.
firewall
ANSWER:
a
Name:
Class:
Date:
Page 2
8. What type of virus is used to lock a user’s system, or cloud accounts until the system’s owner complies by
paying the attacker a monetary fee?
a.
keylogger
b.
rootkit
c.
ransomware
d.
macro
ANSWER:
c
9. Which type of virus is written as a list of commands that can be set automatically to run as soon as a
computer user opens the file?
a.
macro
b.
rootkit
c.
keylogger
d.
adware
ANSWER:
a
10. A malicious computer program that replicates and propagates itself without having to attach to a host is
called which of the following?
a.
virus
b.
Trojan
c.
worm
d.
shell
ANSWER:
c
11. What type of malicious computer programs present themselves as useful computer programs or
applications?
a.
macro viruses
b.
worms
c.
Spyware programs
d.
Trojan programs
ANSWER:
d
12. Which of the following is created after an attack and usually hides within the OS tools, so it is almost
impossible to detect?
a.
toolbox
b.
rootkit
c.
shell
d.
macro virus
ANSWER:
b
13. Trojan Programs can install a specific type of program to allow an attacker access to the attacked computer
Name:
Class:
Date:
Page 3
later. What means of access is the attacker utilizing?
a.
backdoor
b.
shell
c.
worm
d.
macro virus
ANSWER:
a
14. Which of the following sometimes displays a banner that notifies the user of its presence?
a.
Spyware
b.
Adware
c.
Webware
d.
Malware
ANSWER:
b
15. If an attacker wishes to collect confidential financial data, passwords, PINs and any personal data stored on
your computer which of the following programs would they choose to use?
a.
Adware
b.
Spybot
c.
Malware
d.
Spyware
ANSWER:
d
16. The acronym IDS stands for which of the following?
a.
Intrusion Detection System
b.
Information Dissemination System
c.
Information Destruction System
d.
Intruder Dispersal System
ANSWER:
a
17. Which type of program can mitigate some risks associated with malware?
a.
shells
b.
bots
c.
antivirus
d.
rootkits
ANSWER:
c
18. Which type of security is specifically concerned with computers or devices that are part of a network
infrastructure?
a.
Host security
b.
Server security
c.
Computer security
Name:
Class:
Date:
Page 4
d.
Network security
ANSWER:
d
19. Which type of attack cripples the network and prevents legitimate users from accessing network resources?
a.
buffer overflow
b.
session hijacking
c.
social engineering
d.
denial-of-service
ANSWER:
d
20. When a programmer exploits written code that doesn’t check for a defined amount of memory space they are
executing which of the following attacks?
a.
buffer overflow
b.
DoS
c.
DDoS
d.
session hijacking
ANSWER:
a
21. What type of attack causes the victim’s computer to crash or freeze when the attacker delivers an ICMP
packet that is larger than the maximum allowed 65,535 bytes?
a.
MTU ping
b.
Ping of Death
c.
buffer overflow
d.
session hijacking
ANSWER:
b
22. Which type of attack is being carried out when an attacker joins a TCP session and makes both parties think
he or she is the other party?
a.
A DoS attack
b.
Ping of Death
c.
A buffer overflow attack
d.
Session hijacking
ANSWER:
d
23. What type of hardware devices and computer programs can be used to obtain passwords by capturing key
strokes on a targeted computer system?
a.
Viruses
b.
Keyloggers
c.
Macro viruses
d.
Shells
ANSWER:
b
Name:
Class:
Date:
Page 5
24. What type of malicious procedure involves using sniffing tools to capture network communications to
intercept confidential information or gather credentials that can be used to extend the attack?
a.
eavesdropping
b.
overflowing
c.
injecting
d.
capturing
ANSWER:
a
25. Which of the following physical security methods provides the ability to secure a company’s assets and
document any individuals physical time of entry?
a.
rotary locks
b.
combination locks
c.
card access
d.
deadbolt locks
ANSWER:
c
26. What type of attack is occurring when an attacker places themselves between two parties and manipulates
messages being passed back and forth?
a.
Man-in-the-Middle
b.
Ping of Death
c.
Middle-Capture
d.
DDOS
ANSWER:
a
27. When a computer hacker uses multiple compromised computers to carry out a DDOS attack, the
compromised computers are usually referred to as which of the following?
a.
viruses
b.
zombies
c.
macros
d.
cyborgs
ANSWER:
b
28. Which term best describes a hash or code pattern that antivirus software companies use to compare known
viruses to every file on a computer?
a.
signatures
b.
heuristics
c.
macros
d.
bots
ANSWER:
a
29. Which term best describes malicious programmatic behaviors that antivirus software companies use to
compare known viruses to every file on a computer?
Name:
Class:
Date:
a.
signatures
b.
heuristics
c.
macros
d.
bots
ANSWER:
b
30. A computer hacker may use a phishing e-mail to lure a user into following a malicious link. What type of
technique is being used by the computer hacker?
a.
mail fraud
b.
heuristics
c.
ransoming
d.
social engineering
ANSWER:
d
31. How does a buffer overflow attack work?
ANSWER:
In a buffer overflow attack, an attacker finds a vulnerability in poorly written code that doesn’t check for a
defined amount of memory space use. If a program defines a variable size of 64 bytes (the total amount of
memory the variable is supposed to use), and the program writes data over the 64-byte mark without triggering
an error or preventing this occurrence, you have a buffer overflow. The attacker writes code that overflows the
buffer, which is possible because the program accepts unvalidated user input. The trick is to not fill the
overflowed memory with meaningless data but to fill it with executable program code.
32. Explain how a basic computer virus operates and how it uses other host programs.
ANSWER:
A virus is a program that attaches itself to a file or another program. A virus doesn’t stand on its own, so it
can’t replicate itself or operate without the presence of a host. A virus attaches itself to a host file or program
just as the flu attaches itself to a host organism, and then performs whatever the creator designed it to do.
33. Describe the basic function and creation process of a macro virus.
ANSWER:
A macro virus is a virus coded as a macro in programs that support a macro programming language, such as
Visual Basic for Applications. Macro viruses can be coded to carry out many malicious actions, such as
deleting important files, stealing passwords and Web browser history, or allowing remote access to the device.
34. How do Trojan programs operate?
ANSWER:
Trojans disguise themselves as useful programs and can install a backdoor or rootkit on a computer.
Backdoors or rootkits are programs that give attackers a means of regaining access to the attacked computer
later. A rootkit is created after an attack and usually hides itself in the OS tools, so it’s almost impossible to
detect.
35. What types of ports do successful Trojan programs commonly use?
ANSWER:
A good software or hardware firewall would most likely identify traffic that’s using unfamiliar ports, but
Trojan programs that use common ports, such as TCP port 80 (HTTP) or UDP port 53 (DNS), are more
difficult to detect.
36. What is spyware and how does it operate?
ANSWER:
A spyware program sends information from the infected computer to the person who initiated the spyware
Name:
Class:
Date:
any data stored on your computer. You need to make sure your users understand that this information
collection is possible and that spyware programs can register each keystroke entered. It’s that simple. This type
of technology not only exists, but is prevalent. It can be used to record and send everything a user enters to an
unknown person located halfway around the world.
37. What is the difference between spyware and adware?
ANSWER:
The difference between spyware and adware is a fine line. Both programs can be installed without the user
being aware of their presence. Adware, however, sometimes displays a banner that notifies the user of its
presence. Adware’s main purpose is to determine a user’s purchasing habits so that Web browsers can display
advertisements tailored to that user. The biggest problem with adware is that it slows down the computer it’s
running on.
38. Explain the advantages of application whitelisting?
ANSWER:
Whitelisting helps prevent malicious code from being introduced into corporate networks. Application
whitelisting comes in a few different forms, but ultimately it allows only approved programs to run on a
computer. For example, programs such as Word.exe, Excel.exe, and Safari.exe would be whitelisted. All
programs not on the whitelist would be prevented from executing on the user’s computer, including that
malicious program attached to a phishing e-mail a user clicks on.
39. Explain how the two different types of keyloggers are used?
ANSWER:
Keyloggers are hardware devices or software that can be used to capture keystrokes on a computer. Software
keyloggers behave like viruses or Trojan programs. A hardware keylogger is a small device-often smaller than
an inch long. It can usually be installed in less than 30 seconds. It’s a simple matter of unplugging the
keyboard, plugging the keylogging device into a USB port, and then plugging the keyboard into the
keylogging device’s USB port.
40. What is a DDoS attack?
ANSWER:
A distributed denial-of-service (DDoS) attack is launched against a host from multiple servers or workstations.
In a DDoS attack, a network could be flooded with literally billions of packets; typically, each participant in
the attack contributes only a few of the total number of packets. If one server bombards an attacked server
with hundreds or even thousands of packets, available network bandwidth could drop to the point that
legitimate users notice a performance degradation or loss of speed. Now imagine 1000 servers or even 10,000
servers involved, with each server sending several thousand IP packets to the attacked server. There you have
it: a DDoS attack. Keep in mind that participants in the attack often aren’t aware their computers are taking
part in the attack. They, too, have been attacked by the culprit.
Match each item with a statement below.
a.
botnet
b.
rootkit
c.
Trojan
d.
Ping of Death
e.
DoS
f.
Man–in–the-Middle
g.
keyloggers
h.
malware
virus
Name:
Class:
Date:
Page 8
j.
ransomware
41. Network of robot computers
ANSWER:
a
42. A program that usually hides in the OS tools, so it’s almost impossible to detect
ANSWER:
b
43. A program that disguises itself as a useful program and can install a backdoor or rootkit on a computer
ANSWER:
c
44. An attack that uses a large ICMP packet to causes the victim computer to freeze and malfunction
ANSWER:
d
45. An attack that prevents legitimate users from accessing network resources
ANSWER:
e
46. Attackers inject themselves between two parties or systems communicating with one another
ANSWER:
f
47. Hardware devices or software that can be used to capture keystrokes on a computer
ANSWER:
g
48. Malicious software introduced into a network to help an attacker accomplish their goals
ANSWER:
h
49. Malicious program that attaches itself to a file or another program
ANSWER:
i
50. Virus that locks a target system until a demanded fee is paid
ANSWER:
j