Free Malware and Indicators of Compromise practice questions

Code that attaches itself to host files and spreads only when people run those infected files is a virus. A worm copies itself across the network with no host file or user action, a trojan relies on a disguise and doesn't replicate, and a logic bomb waits for a trigger rather than spreading.

In double extortion the group steals a copy of the data before encrypting, so the case is also a data breach, and restoring from backup fixes availability but not confidentiality. Nothing suggests the backups were infected, how the malware spread has no bearing on the publication threat, and no trigger-based code is described.

A worm spreads on its own through a vulnerability, so containment means isolating the infected segment and patching the flaw it exploits. Training doesn't help when no user action is involved, restored hosts reconnected before patching can be reinfected, and macro blocking addresses document-borne viruses rather than network exploitation.

Real ransomware often arrives through a phished credential and spreads with stolen admin rights, but mass encryption with a ransom demand is the primary behavior, so the answer is ransomware. Worm is tempting because of the spread, yet the attackers pushed the tool with stolen rights rather than the code replicating itself. No disguised program or infected host file is described, so trojan and virus don't fit.

Mass renaming with a new extension and a recovery note in every folder are the classic indicators of ransomware encrypting files. Adware shows ads in the browser, spyware works quietly to avoid notice, and a logic bomb's payload doesn't leave instructions for recovering files.

Pop-ups, redirected searches and a hijacked home page after a bundled free download are adware's signature. Spyware is tempting because adware can also track browsing, but spyware is built to collect information without being noticed, while these symptoms are loud by design. A rootkit hides activity and a keylogger records typing.

Covert collection of screenshots and form data sent to an outside host, with nothing visible to the user, is spyware. Adware is noisy with pop-ups and redirects, a logic bomb waits dormant for a trigger, and a worm shows up as network scanning and spreading rather than quiet data collection.

MFA limits the damage from any keylogger, because a captured password alone isn't enough to sign in. Full-disk encryption protects data on a lost or stolen device, tamper-evident seals help find hardware keyloggers rather than software ones, and disabling autorun targets removable media.

A bootkit that lives in firmware loads before the operating system and can survive a reinstall, so the fix is to reset or reflash the firmware and treat the hardware as suspect. A user-mode rootkit would be wiped with the operating system and an on-host scan can't be trusted here anyway, while a logic bomb or adware would not outlive a clean reinstall either.

A logic bomb planted by an insider is a new or altered script or scheduled task, which is exactly what file integrity monitoring flags. It is custom code written by someone with legitimate access, so antivirus signatures are unlikely to match it, and autorun controls and a web application firewall address different routes entirely.