Malware practice questions

Restore the workstation from backup immediately before preserving any evidence.

Why wrong: Immediate restoration could destroy forensic evidence and does not stop the attacker from continuing lateral movement elsewhere.

Run a vulnerability scan against the subnet to see whether the malware exploited an unpatched service.

Why wrong: That may help later in root cause analysis, but it is not the priority while the compromise is still active.

Notify users to ignore the issue until the next maintenance window because the incident is likely self-limiting.

Why wrong: The logs show ongoing malicious activity, so waiting would increase business impact and spread risk significantly.

Run a full antivirus scan first and wait for the results before taking any other action.

Why wrong: A scan is useful later, but it does not immediately stop possible spread or attacker activity.

Reboot the laptop to clear the malicious process from memory.

Why wrong: Rebooting can destroy volatile evidence and may not stop persistence mechanisms from reloading afterward.

Reset the user's password and close the ticket after confirming they can log in again.

Why wrong: Changing a password may help if credentials were stolen, but it does not stop the endpoint infection.

Ransomware, because the browser settings changed after installation.

Why wrong: Ransomware would typically encrypt files or display payment demands. A homepage change alone is not enough to indicate ransomware, and the exhibit instead highlights data collection and tracking.

Rootkit, because the endpoint security console detected an unknown process.

Why wrong: A rootkit is designed to hide malware or give persistent privileged access. The exhibit does not mention kernel-level hiding, disabled security tools, or stealthy privilege escalation, so spyware is a better match.

Worm, because the software was installed from an unofficial website.

Why wrong: A worm spreads itself across systems, usually without user installation. Here the user manually installed a suspicious utility, which is more consistent with spyware or bundled adware behavior than worm propagation.

Reboot immediately to prevent any further damage from the suspected malware.

Why wrong: A reboot can erase volatile evidence such as memory contents, active connections, and running processes.

Copy suspicious files to a shared drive and continue normal operations.

Why wrong: Copying files without proper handling can contaminate evidence and does not preserve volatile activity or system state.

Run a full disk cleanup to remove temporary files and reduce risk.

Why wrong: Cleanup can alter evidence, remove indicators, and interfere with later forensic analysis of the compromised machine.

Delete the scheduled task immediately so the host returns to normal operation.

Why wrong: Deleting artifacts too early can destroy evidence and does not guarantee the malware is removed. It may also cause the attacker to react or trigger secondary payloads. Containment and collection should come before destructive cleanup.

Reimage the workstation from the golden image as the first response.

Why wrong: Reimaging is a remediation step, but it is too early if the team still needs evidence and scope. It can wipe useful traces of execution, persistence, and command-and-control activity before they are preserved.

Ignore the alert because the PowerShell binary is built into Windows and therefore safe.

Why wrong: Built-in tools are often abused by attackers, so the mere presence of PowerShell does not make the event benign. The suspicious execution chain and beaconing behavior require investigation and containment, not dismissal.

Trojan, because the malicious activity likely started from a user-opening event.

Why wrong: A trojan often arrives disguised as legitimate software, but this stem emphasizes memory-only execution and living-off-the-land tooling rather than a simple fake application dropper.

Worm, because the host is making repeated outbound network connections.

Why wrong: Worms self-replicate across systems, usually exploiting network services. Outbound beaconing alone does not prove replication or lateral spread.

Rootkit, because the process is using hidden commands and network connections.

Why wrong: Rootkits are designed to hide presence at the kernel or boot level. Hidden PowerShell and no disk artifact point more strongly to fileless execution than stealthy kernel tampering.

A macro virus that only runs when a document is opened.

Why wrong: Macros can initiate malicious activity, but the observed browser and PowerShell chain points to a broader fileless execution pattern.

A boot sector virus that persists by altering startup code.

Why wrong: Boot sector malware targets disk boot areas, not browser-initiated scripts or outbound web connections.

A logic bomb that activates only when a specific date or event is reached.

Why wrong: Logic bombs are time- or condition-triggered, but they do not explain the observed process injection and command execution pattern.

The current domain name used by the command-and-control server.

Why wrong: The scenario says the domain rotates daily, so it is a poor long-term indicator. It may be useful for temporary blocking, but it is not the most durable clue. Attackers expect defenders to burn these indicators quickly and replace them often.

The public IP address currently hosting the malware sample.

Why wrong: Infrastructure IPs can change quickly, especially when adversaries use disposable hosting or fast-flux style setups. This indicator may help short-term blocking, but it is not dependable for long-term hunting. Behavioral and family-specific artifacts are more resilient for this campaign.

Reimage the workstation immediately before collecting evidence.

Why wrong: Reimaging too soon can destroy evidence that may be needed in the investigation.

Tell the user to keep working until tomorrow.

Why wrong: Telling the user to keep working leaves the threat active and exposed.

Delete recent logs to reduce noise.

Why wrong: Deleting logs removes clues and makes later investigation much harder for responders.

Move all devices into one larger subnet and rely on endpoint antivirus for separation.

Why wrong: This removes any network-level containment and depends too heavily on endpoint detection after compromise occurs.

Place all devices behind a single proxy server and block all internal east-west traffic.

Why wrong: A proxy does not solve internal segmentation for printers and phones, and blocking all east-west traffic would break normal operations.

Enable port security on the switch and disable all VLAN tagging to reduce complexity.

Why wrong: Port security may help with some access control, but it does not provide the needed policy separation across device types.

Trojan, because the attack requires a disguised program to install itself.

Why wrong: A trojan is malware disguised as legitimate software, but the dominant symptom here is encrypted data and a ransom demand, which points to ransomware.

Spyware, because the attacker is likely trying to monitor file activity.

Why wrong: Spyware focuses on covert monitoring and data collection. It does not typically encrypt files or demand payment for restoration.

Logic bomb, because the malware likely triggered after a specific condition was met.

Why wrong: A logic bomb is triggered by a condition or event, such as a date or user action. The visible effects here are encryption and extortion, not a timed trigger.

Worm behavior, because the infection would self-replicate across systems through the network.

Why wrong: Worms focus on spreading to other systems. The key clues here are in-memory execution and document-triggered payloads, not autonomous network propagation.

Rootkit behavior, because the malware is hidden from normal user-mode tools.

Why wrong: Rootkits hide themselves, but the strongest clues here are memory-only execution and script-based launching from Office, not kernel-level hiding or tampering with system visibility.

Ransomware, because the user opened an invoice attachment before the suspicious activity started.

Why wrong: Ransomware would usually encrypt files, rename them, or display a ransom note. The described symptoms are process execution and beacons, not encryption or extortion.

Baiting

Why wrong: Baiting usually offers something tempting, like free media or a giveaway, to lure a victim. This message focuses on fear and account suspension rather than curiosity or reward.

Vishing

Why wrong: Vishing is voice-based social engineering conducted over a phone call or voicemail. This scenario uses email, so it does not fit voice phishing.

Pretexting

Why wrong: Pretexting centers on building a fabricated story to manipulate the target, often in a conversation. While this email includes a story, the most specific label here is phishing through email.

Shut the workstation down immediately and restart it cleanly

Why wrong: Powering off first destroys volatile data that may be critical to understanding the compromise.

Run a disk defragmentation utility to prepare for imaging

Why wrong: Defragmenting changes disk contents and is inappropriate during evidence preservation.

Uninstall the suspected malware before collecting any evidence

Why wrong: Removing suspected malware too early can erase forensic artifacts and destroy the timeline.

Normal software update check

Why wrong: Incorrect. While some software updates use periodic checks, they usually occur at less regular intervals, often with randomized delays to avoid server load, and the data transferred is typically larger (e.g., update manifests or actual patches). The extremely consistent timing and small size are more indicative of beaconing.

DNS tunneling

Why wrong: Incorrect. DNS tunneling exfiltrates data by encoding it in DNS queries, which use UDP port 53 (or sometimes TCP port 53). The traffic described is over TCP port 443 (HTTPS), not DNS, so this pattern does not match DNS tunneling.

Data exfiltration via HTTPS

Why wrong: Incorrect. Data exfiltration via HTTPS typically involves transferring larger volumes of data in a single session or over a shorter period. The steady 1 KB every 5 minutes would take an extremely long time to exfiltrate significant data, making this pattern unlikely for exfiltration. Beaconing is far more probable.

Trojan, because it could have introduced the suspicious service after the initial compromise.

Why wrong: A trojan can deliver a payload, but the key symptom here is concealment from normal tools through kernel-level tampering, which is more specific than a generic trojan infection.

Spyware, because it may collect data while leaving the application functional.

Why wrong: Spyware focuses on stealthy collection or exfiltration. The scenario instead emphasizes hidden processes, hidden files, and a kernel module that alters what the operating system reports.

Logic bomb, because the malware activates after startup and changes what administrators see.

Why wrong: A logic bomb activates when a specific condition is met, such as a date or event. This scenario focuses on persistent concealment and kernel manipulation, not a timed or condition-triggered payload.

Insider threat

Why wrong: While insider threats can cause long‑term damage, they originate from individuals with legitimate access (e.g., employees or contractors). The scenario describes an external attacker moving laterally, not an insider abusing granted privileges. Therefore, this option is incorrect.

Zero‑day exploit

Why wrong: A zero‑day exploit refers to an attack that takes advantage of an unknown vulnerability before a patch is available. While an APT might use a zero‑day exploit as part of its toolkit, the scenario describes the overall campaign (persistence, lateral movement, exfiltration), not a single exploit. Thus, this option is too narrow.

Denial of service (DoS) attack

Why wrong: A DoS attack aims to disrupt service by overwhelming a system with traffic, making resources unavailable. The scenario involves stealthy data theft and long‑term access, not service disruption. Therefore, this option does not apply.

Dismiss the alert because periodic connections are always normal for workstations.

Why wrong: Regular timing can be normal, but unknown destinations still need verification.

Immediately delete the workstation account from the directory service.

Why wrong: Deleting accounts is destructive and not an appropriate first response.

Shut down the entire office network until the analyst can review the alert.

Why wrong: This would be highly disruptive and is not justified by a single alert.

Place the devices on the user VLAN so patching and support tools can reach them easily.

Why wrong: Putting constrained devices on the user VLAN increases exposure to unrelated systems and makes lateral movement easier. Convenience for support does not justify broader trust when the devices have known limitations. A separate segment with narrow access rules is more appropriate for production-floor endpoints.

Allow USB storage so updates can be installed manually whenever needed.

Why wrong: Allowing removable media reintroduces the exact infection path described in the scenario. Even if updates are sometimes needed, unrestricted USB use is not a safe default. A controlled update process or signed package workflow is better than permitting arbitrary removable devices.

Use local administrator accounts with shared passwords to reduce support calls.

Why wrong: Shared local administrator passwords weaken accountability, make credential theft more damaging, and violate least privilege principles. They also create a persistence path for malware or insiders. Support efficiency is not a valid reason to sacrifice identity traceability and privilege control on production devices.

The current domain name because it is the easiest item to block immediately.

Why wrong: The domain may help short-term blocking, but the attacker rotates it frequently, so it will age out quickly.

The cloud provider's entire ASN because all traffic from that provider is automatically malicious.

Why wrong: Infrastructure providers host both legitimate and malicious services, so blocking an entire ASN is overly broad and creates false positives.

The malware's file name because attackers usually keep the same name for convenience.

Why wrong: File names are easy to change and are commonly altered to evade detection or blend in with normal software.