Malware Analysis and Defense # MCQs Practice set

Q.1 Which of the following best describes malware?

A harmful program designed to damage systems
A hardware device
A software patch
A harmless script
Explanation - Malware is malicious software intended to harm, exploit, or otherwise compromise computer systems.
Correct answer is: A harmful program designed to damage systems

Q.2 What does a computer virus typically require to spread?

User action
Automatic execution
Hardware failure
Cloud access
Explanation - Viruses usually need user action, like opening an infected file, to spread.
Correct answer is: User action

Q.3 Which type of malware encrypts files and demands payment?

Ransomware
Trojan
Worm
Adware
Explanation - Ransomware locks files through encryption and asks for ransom payment to restore access.
Correct answer is: Ransomware

Q.4 A Trojan horse malware is disguised as:

Legitimate software
System hardware
Browser cache
Firewall
Explanation - Trojans appear to be legitimate software but perform malicious actions in the background.
Correct answer is: Legitimate software

Q.5 Which malware spreads without user interaction?

Worm
Trojan
Ransomware
Spyware
Explanation - Worms self-replicate and spread automatically across networks without user action.
Correct answer is: Worm

Q.6 What is the primary purpose of spyware?

Steal user information
Encrypt files
Crash systems
Spread viruses
Explanation - Spyware secretly gathers information about users without their consent.
Correct answer is: Steal user information

Q.7 Which malware displays unwanted advertisements?

Adware
Worm
Trojan
Rootkit
Explanation - Adware is designed to automatically deliver or display ads, often intrusive.
Correct answer is: Adware

Q.8 What does a rootkit primarily aim to do?

Hide malicious activities
Show ads
Encrypt files
Spread via USB
Explanation - Rootkits hide processes and files to prevent detection by security tools.
Correct answer is: Hide malicious activities

Q.9 Which file extension is most suspicious for malware distribution?

.exe
.txt
.jpg
.pdf
Explanation - Executable files (.exe) are often used to deliver malware payloads.
Correct answer is: .exe

Q.10 Polymorphic malware is difficult to detect because:

It changes its code frequently
It hides in BIOS
It uses ads
It deletes itself
Explanation - Polymorphic malware mutates its code to evade traditional signature-based detection.
Correct answer is: It changes its code frequently

Q.11 Which tool is commonly used to analyze malware behavior?

Sandbox
Compiler
Text editor
Web browser
Explanation - A sandbox is an isolated environment for observing malware behavior safely.
Correct answer is: Sandbox

Q.12 Which malware type hijacks a user's web browser?

Browser hijacker
Trojan
Ransomware
Spyware
Explanation - Browser hijackers change browser settings and redirect traffic without consent.
Correct answer is: Browser hijacker

Q.13 Keyloggers are used to:

Record keystrokes
Display ads
Encrypt data
Crash networks
Explanation - Keyloggers capture and record user keystrokes to steal sensitive information.
Correct answer is: Record keystrokes

Q.14 Which malware spreads by attaching itself to boot sectors?

Boot sector virus
Trojan
Worm
Spyware
Explanation - Boot sector viruses infect the master boot record, making them hard to remove.
Correct answer is: Boot sector virus

Q.15 Which technique is most effective in preventing phishing-based malware delivery?

User awareness training
Changing hardware
More RAM
Faster processors
Explanation - Educating users helps prevent phishing, a major source of malware infection.
Correct answer is: User awareness training

Q.16 Which of the following is NOT a common malware type?

Trojan
Ransomware
Firewall
Worm
Explanation - Firewall is a security tool, not a type of malware.
Correct answer is: Firewall

Q.17 What is a logic bomb?

Malware triggered by a specific event
Hardware issue
Antivirus patch
Data backup method
Explanation - Logic bombs execute malicious actions when certain conditions are met.
Correct answer is: Malware triggered by a specific event

Q.18 Which malware commonly spreads via email attachments?

Virus
Worm
Trojan
All of the above
Explanation - Viruses, worms, and Trojans can all spread via infected email attachments.
Correct answer is: All of the above

Q.19 What does 'payload' mean in malware?

Malicious action performed
Update package
Antivirus signature
System patch
Explanation - The payload is the harmful activity a malware executes after infection.
Correct answer is: Malicious action performed

Q.20 Which malware resides in memory to avoid detection?

Fileless malware
Ransomware
Trojan
Adware
Explanation - Fileless malware operates directly in system memory, leaving little trace on disk.
Correct answer is: Fileless malware

Q.21 What is the main goal of scareware?

Trick users into buying fake security software
Encrypt files
Record keystrokes
Crash networks
Explanation - Scareware scares users into purchasing unnecessary or fake security tools.
Correct answer is: Trick users into buying fake security software

Q.22 Which of the following best describes a botnet?

Network of infected computers controlled by attacker
Firewall system
Legitimate server cluster
Antivirus lab
Explanation - Botnets are networks of compromised systems used to perform coordinated attacks.
Correct answer is: Network of infected computers controlled by attacker

Q.23 Which malware targets mobile devices most commonly?

SMS Trojans
Boot viruses
Adware only
Rootkits only
Explanation - Mobile malware often spreads via SMS Trojans, stealing information or sending messages.
Correct answer is: SMS Trojans

Q.24 What does 'zero-day malware' refer to?

Exploits unknown vulnerabilities
Old malware strain
Expired virus
Test program
Explanation - Zero-day malware exploits vulnerabilities unknown to vendors or the public.
Correct answer is: Exploits unknown vulnerabilities

Q.25 Which malware is known for mining cryptocurrency on infected systems?

Cryptojacking malware
Ransomware
Worm
Adware
Explanation - Cryptojacking malware secretly uses system resources to mine cryptocurrency.
Correct answer is: Cryptojacking malware