Malware, Social Engineering and Network Attacks practice questions

Phishing

Why it fails: Phishing is typically conducted via email, not phone calls.

Baiting

Why it fails: Baiting involves offering something enticing (e.g., a USB drive) to lure the victim.

Vishing

Why it fails: Vishing is voice phishing, but the key element here is the false identity, which is pretexting.

A normal TCP connection establishment followed by an immediate termination.

Why it fails: While a RST after handshake can occur, the sequence number pattern is suspicious.

A man-in-the-middle attack using ARP spoofing.

Why it fails: ARP spoofing would not be directly observed as TCP sequence numbers in Wireshark.

A TCP SYN flood attack is in progress.

Why it fails: SYN flood involves many SYN packets without completing the handshake.

Slowloris attack

Why it fails: Slowloris is an application-layer DDoS attack that holds connections open, not DNS-based.

UDP flood

Why it fails: UDP flood sends many UDP packets to random ports, not specifically DNS.

DNS tunneling

Why it fails: DNS tunneling encodes data in DNS queries, but the large response size suggests amplification.

Fraggle attack

Why it fails: Fraggle floods UDP echo requests to broadcast addresses, typically port 7 or 19, not ICMP echo requests to multiple external unicast IPs. The spoofed-source ICMP pattern describes a Smurf attack. Fraggle would be correct against a network permitting directed UDP broadcasts.

ICMP flood

Why it fails: An ICMP flood saturates a target with echo requests, but the spoofed source address here points to a reflector or amplifier: the host is the unwitting sender, not the victim. ICMP flood would be correct if the analyst's own host were the overwhelmed target.

Smurf attack

Why it fails: Smurf attack involves sending ICMP echo requests to a network's broadcast address with a spoofed source, causing all hosts to reply to the victim. The scenario lacks a broadcast address and involves multiple external targets, so it is not a Smurf attack.

ICMP flood

Why it fails: An ICMP flood is a Layer 3 (Network Layer) volumetric denial-of-service attack that overwhelms a target's network infrastructure. Attackers send a massive number of ICMP echo request packets, commonly known as "ping flood," to the victim. The target's network devices and host systems expend significant resources processing these requests and generating replies, leading to bandwidth saturation and system unresponsiveness.

SYN flood

Why it fails: A SYN flood is a Layer 4 (Transport Layer) protocol-based denial-of-service attack that exploits the TCP three-way handshake mechanism. The attacker sends numerous TCP SYN requests to the target server but never completes the handshake by sending the final ACK. This leaves the server's connection state tables full of half-open connections, exhausting its capacity to establish new legitimate connections.

UDP flood

Why it fails: A UDP flood is a Layer 4 (Transport Layer) volumetric denial-of-service attack where the attacker sends a large volume of User Datagram Protocol packets to random ports on a target server. Since UDP is connectionless, the server attempts to identify the application listening on each port. When no application is found, the server generates an ICMP "Destination Unreachable" packet, consuming significant bandwidth and CPU cycles, leading to service degradation.

Polymorphic virus

Why it fails: A polymorphic virus is characterized by its ability to constantly change its executable code and encryption key to evade signature-based detection. While its initial infection vector might involve user interaction, such as executing an infected file, the virus itself does not typically require further user action to activate its payload or propagate once resident within a system. Its primary design focus is stealth and persistence, not reliance on ongoing user engagement for its core malicious functions.

Worm

Why it fails: Worms are self-replicating malware designed to spread autonomously across networks by exploiting software vulnerabilities or misconfigurations, rather than relying on user deception. They do not require user interaction, such as opening a file or clicking a link, to activate their payload or propagate to new systems. Their inherent capability for independent network traversal and exploitation distinguishes them from malware types that necessitate direct human engagement for activation.

Tailgating

Why it fails: Tailgating, also known as piggybacking, is a physical security breach where an unauthorized individual gains access to a restricted area by closely following an authorized person. This technique exploits human courtesy or inattention to bypass physical access controls like keycard readers or security checkpoints. It is entirely unrelated to remote, digital login attempts against a computer system or network service.

Baiting

Why it fails: Baiting is a social engineering tactic where an attacker offers something enticing, such as a malware-laden USB drive left in a public place or a tempting download link, to lure a victim into taking an action that compromises their system or data. This method relies on the victim's curiosity or greed to initiate the attack, requiring direct user interaction rather than automated, remote login attempts against a system's authentication mechanism.

Phishing

Why it fails: Phishing is a widespread social engineering attack involving the sending of fraudulent communications, typically via email, SMS (smishing), or voice (vishing), designed to trick individuals into revealing sensitive information or performing actions. Attackers impersonate trusted entities to coerce victims into divulging credentials, financial data, or installing malware. This differs significantly from automated, repeated login attempts directed at a system, which do not involve direct deceptive communication with a user.

SYN flood

Why it fails: SYN flood is a protocol attack at layer 4.

UDP flood

Why it fails: UDP flood is a volumetric attack at layer 4.

It spreads via email attachments only

Why it fails: Polymorphic viruses are not restricted to spreading solely through email attachments. While email is a common vector for many types of malware, polymorphic viruses, like other sophisticated threats, can propagate via numerous methods. These include infected removable media, compromised websites, network shares, and exploiting software vulnerabilities, making the "email attachments only" claim inaccurate and overly restrictive for this class of malware.

It requires a host file to attach

Why it fails: While many viruses, including some polymorphic variants, do indeed require a host file to attach themselves to for execution and propagation, this characteristic is not exclusive or defining for polymorphic malware. This trait is common to most traditional file infector viruses. Other malware types, such as worms, can self-replicate and spread independently without needing to infect an existing host file, demonstrating that host file attachment is not a unique identifier for polymorphic behavior.

It self-replicates without user interaction

Why it fails: The ability to self-replicate without any user interaction is a primary characteristic of a computer worm, not inherently a defining trait of a polymorphic virus. While a polymorphic engine could be incorporated into a worm, many polymorphic viruses still require some form of user action, such as executing an infected program or opening a malicious document, to initiate their initial infection and subsequent propagation cycle. Therefore, this statement is too broad and not specific to polymorphic viruses.

Disabling TCP SYN cookies

Why it fails: SYN cookies defend against SYN flood exhaustion by encoding connection state in the sequence number; disabling them removes that protection. It is tempting because cookies add handshake overhead, so administrators sometimes disable them for performance tuning on trusted internal networks where spoofed-source floods are not a concern.

Using a single server with high bandwidth

Why it fails: A single high-bandwidth server still presents one target: volumetric floods saturate its uplink and any stateful device in front of it. It is tempting because over-provisioning bandwidth absorbs small bursts, which works for modest traffic spikes or load testing, but not distributed attacks exceeding the pipe.

Tailgating

Why it fails: Tailgating is a physical security breach where an unauthorized individual gains entry to a restricted area by closely following an authorized person without their explicit consent. This social engineering tactic relies on human courtesy or distraction, allowing bypass of access controls like card readers or turnstiles. It is fundamentally distinct from network-based login attempts, as it involves direct physical access rather than cyber exploitation.

Phishing attack

Why it fails: Phishing is a social engineering technique where attackers send fraudulent communications, typically emails or text messages, designed to trick recipients into revealing sensitive information or performing malicious actions. Unlike direct login attempts against a system, phishing relies on user interaction, such as clicking a deceptive link or entering credentials into a fake website. This method aims to harvest credentials indirectly from the victim, rather than systematically guessing them on a login portal.

Shoulder surfing

Why it fails: Shoulder surfing is a low-tech social engineering method where an attacker directly observes a victim entering sensitive information, such as passwords or PINs, by looking over their shoulder. This technique requires physical proximity to the target and is an opportunistic form of information gathering, relying on visual theft rather than automated network probes. It is entirely distinct from the automated, remote login attempts described in the question, which occur over a network without direct physical observation.

Polymorphic virus

Why it fails: Polymorphic viruses change their code, but the indicator here is masquerading, not mutation.

Ransomware

Why it fails: Ransomware typically displays ransom notes and encrypts files, not just high CPU usage.

Worm

Why it fails: Worms self-replicate and spread without a host file, but this process masquerades as a legitimate process characteristic of a Trojan.

Whaling

Why it fails: Whaling targets high-profile executives like the CFO, often with CEO impersonation.

Baiting

Why it fails: Baiting involves offering something enticing, like a free USB drive.

Phishing

Why it fails: Phishing is generic mass email, not targeted.

Nmap and Metasploit

Why it fails: Nmap and Metasploit are powerful tools for network reconnaissance and exploitation, respectively, but they do not directly facilitate a Man-in-the-Middle (MITM) attack. Nmap is primarily used for port scanning, service enumeration, and operating system detection, gathering information about targets. Metasploit is an exploitation framework designed to deliver payloads and gain control over systems, not to intercept and relay network traffic between two parties.

Aircrack-ng and Wireshark

Why it fails: Aircrack-ng is a suite of tools specifically designed for auditing wireless networks, primarily focused on cracking WEP/WPA/WPA2 keys to gain unauthorized access to Wi-Fi. While Wireshark can capture network traffic, Aircrack-ng does not provide the necessary mechanisms, such as ARP poisoning, to position an attacker in the middle of a wired or even an already-accessed wireless network communication path. Its core function is network access, not traffic interception for MITM.

Ettercap and Nmap

Why it fails: Ettercap is an excellent tool for performing Man-in-the-Middle attacks, particularly through ARP poisoning on a local area network. However, Nmap's role is network mapping and host discovery, identifying active devices and open ports. While reconnaissance is a preliminary step in many attacks, Nmap does not actively participate in the traffic interception and forwarding required for a MITM attack, making this combination incomplete for the direct execution of the attack.

Trojan

Why it fails: A Trojan horse is a type of malware that masquerades as legitimate software to trick users into executing it. Once activated, it creates a backdoor, allowing malicious actors to gain unauthorized access and control over the compromised system. While a Trojan can *deliver* various payloads, including ransomware, its fundamental design is deception and payload delivery, not the file encryption and ransom demand itself.

Spyware

Why it fails: Spyware is malicious software specifically engineered to secretly monitor and collect information about a user's activities without their knowledge or consent. This can include keystrokes, browsing history, application usage, and sensitive personal data, which is then transmitted to an attacker. Its core function is clandestine data exfiltration and surveillance, not the encryption of files for extortion purposes.

Adware

Why it fails: Adware is software that automatically displays unwanted or intrusive advertisements, often in the form of pop-ups, banners, or redirects, to generate revenue for its creator. While it can degrade system performance and user experience, its primary function is advertising delivery and data collection for targeted ads, not the encryption of user files or system lockout for ransom.

It spreads through network shares without requiring user interaction.

Why it fails: This describes a worm, not a polymorphic virus.

It remains dormant until a specific date or time.

Why it fails: This describes a logic bomb or time bomb, not polymorphism.

It infects the master boot record of a hard drive.

Why it fails: This describes a boot sector virus, not necessarily polymorphic.

Disabling recursive queries on DNS servers

Why it fails: Disabling recursive queries prevents the server from being used as a reflector, which is effective, but rate limiting is a broader mitigation. However, disabling recursion is a specific control. The question asks for the most effective among these, and rate limiting is a standard mitigation.

Deploying anycast routing

Why it fails: Anycast distributes traffic across multiple servers, but does not prevent amplification.

Using a scrubbing center

Why it fails: Scrubbing centers filter malicious traffic but are not specific to DNS amplification.

Duplicate IP addresses in the ARP table

Why it fails: When an ARP spoofing attack is underway, the victim's ARP table may contain multiple entries for the same IP address, each mapped to a different MAC address. This occurs because the attacker sends unsolicited ARP replies claiming to be the legitimate gateway or host, causing the victim's system to update its cache with the attacker's MAC address for the target IP, while the original, legitimate entry might still exist or be intermittently re-added. This inconsistency directly reveals the manipulation of ARP mappings.

A sudden spike in DNS traffic

Why it fails: A sudden spike in DNS traffic is not a direct indicator of ARP spoofing. While an attacker might combine ARP spoofing with DNS manipulation, the spike itself points to issues within the DNS protocol, such as a DNS amplification attack, a misconfigured DNS server, or an attempt at DNS cache poisoning where a malicious server floods clients with incorrect records. ARP spoofing primarily manipulates local network layer 2 mappings, not the volume or nature of DNS queries.

SYN flood

Why it fails: A SYN flood exhausts the TCP connection table by sending half-open handshake requests, which is a transport-layer attack. It is tempting because it consumes server resources and looks like legitimate connection attempts, but it never reaches HTTP or application parsing.

Smurf attack

Why it fails: A Smurf attack floods a victim with ICMP echo replies by spoofing the victim's address to a network's broadcast address, operating at the network layer. It is tempting because it amplifies traffic dramatically, but amplification alone does not make an attack application-layer.

UDP flood

Why it fails: A UDP flood sends volumes of UDP packets to random ports, exhausting bandwidth and processing at the transport layer, with no HTTP or application request involved. It is tempting because it is a classic volumetric DDoS, but it targets Layer 3/4 rather than application protocols.

Analyzing network traffic

Why it fails: Network traffic analysis is dynamic analysis.

Running the malware in a sandbox

Why it fails: Running in sandbox is dynamic analysis.