Computer Security Questions and Answers

Answer: B

Correct answer: Worm

A worm is distinguished from a virus precisely by independence: it needs no host program and no user action, but propagates itself across a network, and the traffic it generates is what disrupts communication. Trojans do not self-propagate, and a dropper merely installs other malware.

Answer: A

Correct answer: Antivirus

Antivirus software scans for code matching its database of known threats and removes what it finds. Adware displays advertisements, a key logger records keystrokes, and firmware is code held in hardware.

Answer: D

Correct answer: Virus

Code Red was a worm that attacked Microsoft IIS web servers in 2001, and in the loose usage of these questions it is classed as a virus - that is, as malicious code rather than as any kind of application.

Answer: B

Correct answer: The CD–ROM stops functioning

A drive that stops working is a hardware fault; nothing in a virus's usual repertoire disables the mechanism. The other three - files and icons vanishing, the browser's home page changed, strange messages on screen - are all things software can do and all classic signs of infection.

Answer: B

Correct answer: Zombie

A zombie is a machine that has been taken over and is used, together with thousands of others, to flood a target with traffic. The collection of them is a botnet, and the flood is the denial of service. A worm may be the means of recruiting them, but the attack itself is launched by the zombies.

Answer: A

Correct answer: ii, i, iv and iii

A virus passes through four phases in order: it lies dormant after infection, then propagates copies of itself into other programs, then is triggered by some event, and only then executes its payload. Spreading before acting is what makes a virus dangerous, so propagation must precede execution.

Answer: D

Correct answer: Parasitic Virus

A parasitic virus attaches itself to an executable file and, each time that program is run, looks for other executables to infect. The name reflects the arrangement: the virus cannot live without a host program. A macro virus attaches to documents instead, and stealth and polymorphic describe how a virus evades detection rather than what it attaches to.

Answer: C

Correct answer: Stealth virus

A stealth virus is built to conceal itself - intercepting the calls antivirus software makes so that infected files appear unchanged in size and content. Polymorphism also frustrates detection, but by changing the virus's own appearance rather than by hiding the evidence of infection.

Answer: A

Correct answer: Polymorphic Virus

A polymorphic virus encrypts itself with a different key each time it copies itself, so every copy does the same thing while having a different bit pattern. That is what defeats signature-based scanning, which looks for a fixed sequence of bytes.

Answer: D

Correct answer: mutation engine

The part of a polymorphic virus that generates the random key and rewrites the encrypted body is called the mutation engine. The other three names are not used.