Malware and Attack Vectors Questions and Answers

Answer: D

A logic bomb triggers on a specific time or system condition.

A logic bomb is malicious code that lies dormant until a predefined condition is met: a date and time (then also called a time bomb), a particular user logging in, a file being deleted, or, in a classic insider case, the programmer's name disappearing from the payroll. Hidden inside a Trojan, it lets the malware stay quiet until the chosen moment.

A failed checksum, privilege escalation and kernel module loading are things malware may cause or exploit, but they do not define how a logic bomb is triggered; what makes it a logic bomb is the trigger condition.

Answer: A

The malware is the Trojan horse.

A Trojan horse is malicious software disguised as something legitimate, such as a free game or a fake update. Once the user installs it, it carries out hidden actions such as stealing data, opening a backdoor or downloading other malware. Unlike a virus or worm, it does not replicate itself.

Encryption is a protection technique (even though ransomware misuses it). A firewall filters network traffic, and a VPN creates an encrypted tunnel over a public network. All three are security measures, not malware.

Answer: B

Phishing primarily targets user credentials and personal information.

Phishing is social engineering: fake emails, messages or websites imitate a trusted bank, company or colleague to trick the victim into revealing passwords, OTPs, card numbers or personal details, or into installing malware. It attacks the human user rather than a technical weakness.

DNS servers are the target of DNS spoofing or cache poisoning, which can redirect users to fake sites (pharming), a related but different attack. HTTP cookies are stolen in session hijacking. Hardware is not what phishing goes after.

Answer: C

The attack is a DDoS attack.

In a Distributed Denial of Service attack, many compromised machines, often a botnet, send a flood of requests or packets to a target at the same time. The server or its network link is overwhelmed and cannot serve genuine users. Because the traffic comes from thousands of sources, simply blocking one address does not stop it.

SQL injection inserts malicious SQL through input fields. A man-in-the-middle attack secretly intercepts or alters communication between two parties. A brute-force attack tries passwords or keys systematically. None of them works by flooding a server with traffic.

Answer: B

The attack is Distributed Denial of Service (DDoS).

In a DDoS attack, many compromised machines (a botnet) send traffic to one target at the same time, overwhelming its bandwidth or resources so that genuine users cannot reach it.

Phishing tricks people into revealing information, SQL injection inserts malicious SQL into an application's queries, and ransomware encrypts a victim's data for a ransom; none relies on many devices flooding a target.

Answer: B

Phishing is a technique used to deceive people into revealing personal information.

Phishing uses fake emails, messages or websites that look as if they come from a bank or another trusted source, to trick people into giving away passwords, card numbers or other sensitive data.

It is a form of social engineering rather than technical hacking, and it is the opposite of a protective measure such as encryption or a firewall.

Answer: C

The malware is Ransomware.

Ransomware encrypts or locks a victim's files or system and demands payment, often in cryptocurrency, for the key to unlock them, as in the WannaCry attack of 2017.

A Trojan horse disguises itself as useful software, spyware secretly collects information, and a worm spreads itself across networks; none of them is defined by holding data to ransom.

Answer: A

The key gives A vulnerability that is not yet discovered.

A zero-day is a flaw that the software's developer does not yet know about, so there has been 'zero days' to fix it and no patch exists. A zero-day exploit is an attack that uses such a flaw. The key's wording means 'not yet discovered' by the vendor; the attacker, of course, has found it.

A patched vulnerability is the opposite case, security software usually cannot stop a zero-day because it has no signature for it, and a software update is the eventual remedy.

Answer: D

The one that is not a cybercrime is AES.

AES, the Advanced Encryption Standard, is a symmetric encryption algorithm adopted by the US NIST in 2001 and used worldwide to protect data. It is a security tool, not an offence.

The others are attacks: denial (here 'refusal') of service floods a system so legitimate users cannot reach it, a man-in-the-middle secretly intercepts communications, and phishing tricks people into revealing credentials.

Answer: A

The technique is Pharming.

In pharming, attackers redirect users from a genuine website to a fake one, for example by poisoning DNS records or altering a computer's hosts file, so that even typing the correct address leads to the fraudulent site, where credentials are stolen.

Spamming is sending bulk unsolicited messages. 'Mimicking' and 'website-duplication' describe parts of the idea loosely but are not the established name of the technique.