Free Types of Malware and Tools/Methods for Detection, Removal, and Prevention practice questions

Repairing the boot records and startup configuration is the correct first action because the failure occurs before Windows can even locate a bootable device. Messages such as 'boot device not found' or looping before the logo point to a damaged or misconfigured boot path, and boot repair actions restore the system's ability to find and start Windows. Copying and replacing the core system files targets failures that occur during Windows loading, such as crashes with file-related errors, not a pre-Windows inability to find a boot device. Disabling recently installed services and drivers addresses boot loops caused by a bad driver after the system has begun loading Windows, which is not the stage where this failure happens. Restoring the last known good configuration rolls back settings and some system state after a change caused instability, but it assumes Windows can locate and begin loading, which it cannot in this scenario. The practical rule is to match the action to the failure stage: pre-Windows failures point to boot repair, failures during loading point to drivers or system files, and read/write errors point to disk and file system checks.

Adware is the correct answer because it is a potentially unwanted program that pushes advertisements onto a device, often by redirecting the browser, injecting pop-ups, and changing the homepage or default search engine to route traffic through pages that earn ad revenue. Its arrival bundled with a free tool like a PDF converter is a classic delivery method. Spyware focuses on secretly monitoring activity, such as capturing browsing history and credentials, and its defining trait is stealth rather than visible ads and redirects. A memory hook is that spyware hides while adware shouts. A rootkit conceals its presence and provides persistent privileged access to a system, not overt browser advertisements. A worm is self-replicating malware that spreads across networks without user interaction, which does not match a user-installed program that displays ads. The visible symptoms of redirects, pop-ups, changed search settings, and a program the user did install after clicking through a bundled installer all point clearly to adware.

Deploying a Managed Detection and Response (MDR) service is correct because MDR adds trained analysts who monitor alerts 24/7, perform human-led triage, and provide incident guidance such as which device to isolate first and what logs to collect. This directly solves the problem of overnight alerts going unreviewed until morning without the organization hiring more internal staff. Installing an additional endpoint antivirus suite adds signature-based file detection but provides no human monitoring or overnight triage, and running multiple AV products can cause conflicts. Enabling extended logging on all endpoints increases the data available but does nothing to review or act on alerts around the clock; more logs without analysts simply means more unread noise. Adding a second EDR agent to each device duplicates the same tooling the team already struggles to monitor and can cause performance and detection conflicts. The key distinction for the exam is that EDR is the tool on the endpoint, while MDR is the managed service of people, process, and tools that runs detection and response continuously. When a team cannot watch alerts all day, MDR is the appropriate fit.

XDR (Extended Detection and Response) is correct because it connects events from multiple systems, such as email security, identity providers, endpoints, and network or DNS logs, into one investigation view with a shared timeline. By correlating the same user, host, and time window across sources, XDR turns scattered alerts into a single coherent attack chain, exactly what is needed to link a phishing email, a suspicious login, an endpoint process, and outbound traffic. EDR watches and responds on individual endpoints by tracking process behavior, but it focuses on the device itself and does not natively correlate email, identity, and cloud signals into one story. The Recovery Console is a Windows repair environment used to fix boot and system failures when Windows will not start; it has no security correlation function. Signature-based antivirus identifies known malicious files by matching patterns and cannot connect behavioral events across email, identity, and network sources. The core value of XDR is correlation, which reduces the hardest part of incident work: deciding whether separate facts belong together.

Confirming the BitLocker recovery key is available is the most important step to prevent permanent loss of access, because some repair actions can trigger BitLocker recovery mode. If encryption is enabled and the key is missing, the technician can be locked out of the encrypted data entirely, making this the highest-impact precaution before repairs. Recording the exact wording of error messages and any stop codes is valuable because those details point to boot, driver, or disk causes, but it does not protect against losing access to encrypted data. Disconnecting external drives and USB devices prevents a bad dock or bootable device from hijacking the boot order, which improves the repair process but does not safeguard data access on an encrypted volume. Documenting recent updates and driver changes helps choose a rollback path instead of guessing, yet it also does nothing to preserve access if a repair invokes BitLocker recovery without the key. All four are part of a safe workflow, but only verifying the recovery key directly prevents the catastrophic outcome of being permanently locked out of encrypted data.

The correct explanation is that the site was granted notification permission and the fix is to revoke it in the browser's site permission settings. Notification abuse is a common adware tactic: a page prompts the user to 'Allow notifications,' and once approved, the browser legitimately displays constant ad notifications on the desktop. The browser is simply honoring the permission it was given, so clearing or restricting the Notifications permission stops the behavior. Claiming a rootkit installed at the kernel level and demanding a full reimage is a drastic overreaction that does not match a simple permission grant and would cause unnecessary data disruption. Stating the network DNS was hijacked and flushing the DNS cache addresses redirect-through-DNS scenarios, not desktop notification spam triggered by a browser permission. Suggesting a keylogger is capturing input and running a credential scan misidentifies the symptom entirely, since notification pop-ups do not indicate keystroke logging. The lesson is to teach users to deny notification prompts from unfamiliar sites and to review and clear site permissions during troubleshooting rather than assuming a deep infection.

Behavioral analysis of process activity is correct because EDR watches what a device does rather than only what files it contains. The suspicious chain of a document launching a command shell that spawns encoded PowerShell reaching an unfamiliar domain is a behavioral pattern common in phishing-based attacks, and EDR flags it even when no known-bad file is present. Signature matching of known malware files is the traditional antivirus method that looks for patterns tied to known samples; attackers evade it by modifying files or living off legitimate tools like PowerShell, which is exactly why signatures often miss this activity. Scheduled full-disk offline scanning checks files at rest on a fixed schedule and would not detect a live, in-memory process chain as it unfolds. Blocklisting of unapproved application names would not help here because every process in the chain, including Word, cmd, and PowerShell, is a legitimate signed Windows program that is not on any blocklist. The key concept is that signatures identify known 'bad,' while behavior identifies what is 'wrong for this device,' allowing EDR to catch clean files performing unsafe actions.

A potentially unwanted program is the umbrella term for software the user never really meant to install, usually bundled with a free download, and adware, software whose purpose is to push advertisements and redirect browsing, is one common kind of PUP. Neither label means 'always malicious': PUPs are by definition borderline software that is unwanted rather than outright malware, and adware is far from harmless since it hijacks search settings and can lead to malicious sites. The reversed relationship is wrong; adware is the example and PUP is the category. PUPs do not self-propagate; spreading without user action is what defines a worm, and both PUPs and adware typically arrive through the same bundled installers the user clicks through.

The organization's internal IT team holds primary responsibility because MDR reduces workload but does not remove ownership of core inputs such as asset inventory. The provider cannot protect or monitor systems it cannot see, so if a device is missing from the inventory, it typically ends up missing from monitoring as well. Maintaining which endpoints exist, who owns them, and which are high risk remains the organization's job. The MDR provider's analyst staff performs triage, threat hunting, and response guidance on the assets and telemetry they are given, but they rely on the organization to supply an accurate inventory and keep agents deployed. The endpoint's default security vendor supplies software, not an obligation to enroll every corporate device into the organization's monitoring program. The XDR correlation platform itself only connects and analyzes the signals it receives; it cannot account for a device that was never onboarded or logging. The exam expects you to know that with a managed service, the customer still owns asset inventory, patching, account controls, endpoint compliance, and approvals, treating MDR as an extension of the team rather than a replacement for internal controls.

A cryptominer hijacks CPU or GPU resources to mine cryptocurrency for an attacker, and the clearest symptoms are performance and heat rather than pop-ups. High processor use at idle, loud fans, unusual device heat, and rapid battery drain are classic signs, and cryptominers frequently hide inside browser extensions that spike usage when the browser launches. Ransomware is built for extortion, so its symptoms are unreadable files, changed file extensions, and ransom notes, not sustained CPU load and heat. A boot sector virus targets the early startup area of a disk and produces boot loops or 'missing operating system' errors before the OS loads, which does not match browser-triggered CPU spikes. A keylogger captures keystrokes to steal credentials and typically runs quietly in the background without causing high resource use or overheating. Because the payoff depends on running for as long as possible, cryptominers try to stay persistent, so the fix focuses on removing the malicious extension and other persistence points such as startup items and scheduled tasks, then finding the source that keeps reintroducing the miner.