Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA A+ Certification Prep 3: Network/Security > Lesson 10 - Chapter 1: Malware > Flashcards

Lesson 10 - Chapter 1: Malware Flashcards

1
Q

What is malware?

A

software designed to do something harmful to a system or network

(maldad)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are 4 of the many types of malware?

v, b, t, r

A
  1. Virus
  2. Boot Sector Virus
  3. Trojan Horse
  4. Rootkit
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a virus?

A

a program with 2 jobs: to replicate and to activate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is replication? (Virus)

A

it makes copies of itself by injecting itself as extra code added to the end of executable programs or hiding out in a drive’s boot sector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is activation? (Virus)

A

when a virus does something like corrupt data or steal private information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A virus only replicates to….

A

other drives (thumb drives, optical media)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Can a virus replicate itself across networks?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A virus needs ___ ___ to spread

A

human action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a boot sector virus?

A

a virus that infects the boot sector of the hard drive (so the virus loads on boot)

(stays in memory, infects other files as they run)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a Trojan Horse?

A

malware that pretends to do one thing but behind the scenes does something evil

(can be a game, fake security program, etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Can a Trojan Horse replicate?

A

No

(viruses do replicate though)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a Rootkit?

A

a program that takes advantage of very low-level operating system functions to hide itself from all but the most aggressive anti-malware tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A rootkit by definition gains privileged access to a computer, which can strike what 3 things?

A
  1. Operating systems
  2. Hypervisors
  3. Firmware (hard drives, accessories)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are 5 bad things malware can potentially do?

S
R
Z, b
C
G

A
  1. Harvest private information (spyware)
  2. Hold files for ransom (ransomware)
  3. Use the PC to attack other systems (zombie; botnet)
  4. Cryptomine
  5. Gain a foothold in the system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is spyware?

A

software that spies on the computer user, collecting info about their activities and habits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Keyloggers are what type of software?

A

spyware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are keyloggers? are they all malware? (2)

A

keyloggers log the user’s keystrokes and sends the data back to the spyware creator (harvesting important info like passwords, cc numbers)

not all are malware, parental controls use keyloggers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is ransomware?

A

encrypts all the data it gains access to on a system and even mapped network drives!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What happens after ransomware locks up all your data?

A

the ransomware application pops up a message asking for money (often bitcoins) to decrypt your data often with a timer and if it reaches 0 triggers the deletion of the encryption keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What’s a zombie?

A

an infected computer that obeys the commands of the malware creator

(zombie puppet)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a botnet?

A

a network of infected computers under the control of a single person or group

(can easily grow into millions of zombies for large networks)

[zombie horde]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a bot herder? What does it activate?

A

controls the botnet actions, activates scripts installed on the zombies to launch an attack

[Puppet master]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What’s one of the most common ways to send spam?

A

using botnets (use hacked/stolen bandwidth)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which method is used to launch Denial of Service (DoS) and Distributed DoS (DDoS) attacks?

A

botnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is crypto mining?

A

using a computer’s processing power to “mine” for cryptocurrency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What malware method is used for crypto mining?

A

botnets

(malware creators use bots to take control of zombies and steal processing power as a mining ‘team’)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How does malware help a criminal gain a foothold in the system?

A

some malware creates a backdoor that cybercriminals use to access the system’s data (can harvest info and sell it)

28
Q

What’s one tricky thing about how malware presents?

A

it can appear like normal PC “wonkiness”

(momentary slowdowns, random one-time crashes, etc)

29
Q

What are 8 symptoms of a PC infected by malware?

  1. sl
  2. ap
  3. cha
  4. me
  5. up
  6. lo
  7. ov
  8. se
A
  1. Slow PC
  2. Application crashes
  3. Changed permissions or missing or renamed files
  4. Messages you didn’t send
  5. Update/Protection software stops working
  6. Loss of Internet connectivity
  7. Overwritten Hosts file
  8. Security alerts
30
Q

A slow PC can mean what 2 things?

A
  1. too many applications are open at once
  2. system hit with malware (like a botnet using up CPU)
31
Q

How do you tell the difference between a normal application crash and malware?

A

if it’s happening a lot (even when all applications are closed)

(also goes for frequent lockups too)

32
Q

What does malware try to do to system files?

A

rename system files, change file permissions, or hide files

33
Q

How would you know when malware is fighting back?

A

Windows Update stops working or tools show up as “Access Denied”

34
Q

What do you do if removing malware broke your Internet connection?

A

reinstall your NIC and its drivers, reboot router, etc

35
Q

What is a Hosts file?

A

overrules any DNS settings and can redirect your browser to whatever site the malware adds to the file

36
Q

How would you know if malware has overwritten your hosts file?

A

you type in one web address and end up at a different site

37
Q

What is rogue anti-malware?

A

free anti-malware applications that are actually malware

38
Q

The only way to permanently protect your PC from malware is to what?

A

disconnect it from the Internet (unlikely scenario)

39
Q

What are 4 tools you have for combating malware?

A
  1. Anti-malware software
  2. Training and awareness
  3. Patch management
  4. Remediation
40
Q

What 2 ways does an anti-malware product protect your PC?

A
  1. Active seek and destroy mode
  2. Passive sentry mode
41
Q

Is antivirus software the same as anti-malware?

A

malware is a more generic term and refers to all types, antivirus is an older term to remove viruses. today, antivirus software can also target non-virus malware.

42
Q

How do anti-malware programs detect boot sector viruses?

A

they compare the driver’s boot sector to a standard boot sector because most boot sectors are the same

43
Q

___ viruses are harder to find because they can be found on any file in the drive

A

executable viruses

44
Q

What does an anti-malware program use to detect executable viruses?

A

it uses a library of signatures

45
Q

What are signatures?

A

a code pattern of known viruses

(virus code patterns, a virus’s signature)

46
Q

Where is the library of signatures stored?

A

in a definition file

47
Q

Anti-malware programs compare each executable file to its library of ____

A

signatures

48
Q

The first line of defense shouldn’t be anti-malware but ___ ___

A

user education

49
Q

What is patch management?

A

keeping systems patched

(automatic updating OS, otherwise update it manually)

50
Q

What are the 7 steps to take to remediate malware?

On the A+ exams

A
  1. Identify malware symptoms
  2. Quarantine infected system
  3. Disable System Restore (Windows)
  4. Remediate infected systems (update anti-malware software, use scan and removal)
  5. Schedule scans and run updates
  6. Enable System Restore and create a restore point (Windows)
  7. Educate end users
51
Q

What are 2 signs a PC might be infected?

A
  1. Starts spewing emails
  2. Was running fast yesterday but today it’s sluggish
52
Q

What are 2 ways to disconnect and quarantine a system?

A
  1. Software employed on a network that automatically monitors and cuts off a machine from the network if it starts to send suspicious packets
  2. Manually disconnect the network cable
53
Q

Before making any changes to get rid of the virus/malware, what should you do? Why?

A

disable System Restore so the virus isnt’ included in any restore points going forward

54
Q

How do you turn off System Restore in Windows?

A

Settings > System > About > System Protection > Select Drive > Configure > Disable system protection

55
Q

What kinds of events might malware leave traces of in Event Viewer? (3)

A
  1. Destabilizing programs
  2. Disabling protection services
  3. Triggering warnings about resource use
56
Q

What do you do after you’ve isolated the infected computer(s)?

A

get to a safe boot environment and run anti-malware software

(try Windows Recovery Environment first bc it only requires a reboot)

57
Q

How do you boot into the Windows Recovery Environment?

A

Hold down SHIFT as you click the POWER button on the START menu

58
Q

What do you do if you suspect a boot sector virus and can’t use Windows Recovery Environment?

A

use an external bootable source (bootable CD or USB flash drive)

59
Q

Get into the habit of keeping around a bootable anti-malware flash drive or optical media so you…?

A

can use the boot media if you suspect a virus or other malware, even if the anti-malware program says it eliminated the problem

(boots you into a clean environment)

60
Q

How do you boot from an anti-malware disc or drive?

A

change CMOS settings to boot to optical or USB media

61
Q

What options do you have for creating a bootable optical disc or flash drive? 3

A
  1. Anti-malware software in a bootable version (Avast! Virus Cleaner Tool)
  2. Download a copy of Linux that offers a live CD/DVD option like Ubuntu so you can boot to the disc and install a complete working copy of the OS into RAM to be Internet-ready and access anti-malware sites for tools
  3. Download and burn a copy of Ultimate Boot CD (contains several anti-malware programs but out of date)
62
Q

What do you do after you get into a boot environment?

A

you update your anti-malware software and run its most comprehensive scan and check all removable media exposed to the system and any system that received data from it

63
Q

When would you need to turn to an external (anti-malware) boot environment?

A

When Windows Recovery Environment doesn’t work or it might be a boot sector virus

64
Q

What does remediation mean?

A

Fixing files that the malware harmed

65
Q

What do you do if you can’t start Windows after the malware scan is finished?

A

boot from Windows setup media and use the Windows Recovery Environment/System Recovery options

66
Q

What should you remember to do after the system has been repaired?

A

re-enable System Restore and create a new restore point

CompTIA A+ Certification Prep 3: Network/Security (45 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions