Topic 08 Practice Test 3 covers Indicators of Malicious Activity for CompTIA Security+ SY0-701 and maps to objective 2.4: Given a scenario, analyze indicators of malicious activity. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
Which term describes security-relevant activity recorded at an unusual time compared with normal operational patterns?
- Out-of-cycle logging
- Rootkit
- Birthday attack
- Virus
Correct Answer: A
Correct Answer
Answer A is correct because Out-of-cycle logging means security-relevant activity recorded at an unusual time compared with normal operational patterns. The deciding point is functional fit: this option covers the stated need, while Rootkit addresses malware designed to maintain privileged hidden access and conceal its presence.
Incorrect Answers
Answer B is incorrect because Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence. That concept can be valid in another scenario, but this question is testing security-relevant activity recorded at an unusual time compared with normal operational patterns; Out-of-cycle logging therefore fits the requirement more directly.
Answer C is incorrect because Birthday attack refers to a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. The scenario instead requires security-relevant activity recorded at an unusual time compared with normal operational patterns, which is why Out-of-cycle logging is the better answer; this option serves the different function defined above.
Answer D is incorrect because Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed. The key mismatch is functional: Out-of-cycle logging addresses security-relevant activity recorded at an unusual time compared with normal operational patterns, the need stated by the question.
Question 2
To recognize movement from a lower-privilege context to higher authority, which security approach should be selected?
- RFID cloning
- Missing logs
- Privilege escalation
- DDoS amplification
Correct Answer: C
Correct Answer
Answer C is correct because Privilege escalation means an attack that obtains permissions beyond those originally granted. That makes it the best answer here; Missing logs addresses absence of expected telemetry or audit records, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because RFID cloning refers to copying or emulating data from an RFID credential. The question is not asking for this function. It is testing an attack that obtains permissions beyond those originally granted, so Privilege escalation is the stronger fit.
Answer B is incorrect because Missing logs refers to absence of expected telemetry or audit records. The scenario instead requires an attack that obtains permissions beyond those originally granted, which is why Privilege escalation is the better answer; this option serves the different function defined above.
Answer D is incorrect because DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. That concept can be valid in another scenario, but this question is testing an attack that obtains permissions beyond those originally granted; Privilege escalation therefore fits the requirement more directly.
Question 3
Which denial-of-service technique causes third-party systems to send responses larger than the attacker’s requests toward a victim?
- DDoS amplification
- Ransomware
- Out-of-cycle logging
- RFID cloning
Correct Answer: A
Correct Answer
Answer A is correct because DDoS amplification means a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. The requirement maps directly to this function, whereas Ransomware is aimed at malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession.
Incorrect Answers
Answer B is incorrect because Ransomware refers to malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. The concept is valid, but it does not match this stem. The required function is a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim, which maps to DDoS amplification.
Answer C is incorrect because Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns. The question is not asking for this function. It is testing a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim, so DDoS amplification is the stronger fit.
Answer D is incorrect because RFID cloning refers to copying or emulating data from an RFID credential. This could be appropriate elsewhere, but the required function is a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim; that makes DDoS amplification the precise choice.
Question 4
An architect working on a SOC investigation of suspicious activity needs one capability that provides malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession and another that provides reuse of captured authentication data or tokens to impersonate a legitimate user or system. Which TWO selections are the best match? Choose TWO.
- Virus
- Credential replay
- Missing logs
- Injection attack
- Ransomware
Correct Answers: B, E
Correct Answers
Answer B is correct because Credential replay means reuse of captured authentication data or tokens to impersonate a legitimate user or system. It belongs in the fixed-count answer set because it covers one of the stated requirements. Injection attack instead serves an application attack that causes untrusted input to be interpreted as commands, queries, or code and cannot replace this function.
Answer E is correct because Ransomware means malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. The fixed-count item needs this function in the answer set. Injection attack covers an application attack that causes untrusted input to be interpreted as commands, queries, or code, a different requirement.
Incorrect Answers
Answer A is incorrect because Virus means malware that attaches to a host file or other object and replicates when the infected host is executed. Every answer slot must map to a stated requirement. The correct set is Credential replay, Ransomware, so this option cannot replace one of those selections.
Answer C is incorrect because Missing logs means absence of expected telemetry or audit records. The scenario calls for Credential replay, Ransomware. Selecting this option would leave one of those required functions uncovered. For example, Credential replay is required for reuse of captured authentication data or tokens to impersonate a legitimate user or system.
Answer D is incorrect because Injection attack means an application attack that causes untrusted input to be interpreted as commands, queries, or code. The required choices are Credential replay, Ransomware. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 5
To recognize successful access using previously captured authentication material, which security approach should be selected?
- DDoS amplification
- Worm
- Credential replay
- Virus
Correct Answer: C
Correct Answer
Answer C is correct because Credential replay means reuse of captured authentication data or tokens to impersonate a legitimate user or system. The requirement maps directly to this function, whereas Worm is aimed at self-propagating malware that spreads between systems without requiring a user to copy each instance.
Incorrect Answers
Answer A is incorrect because DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. The scenario instead requires reuse of captured authentication data or tokens to impersonate a legitimate user or system, which is why Credential replay is the better answer; this option serves the different function defined above.
Answer B is incorrect because Worm refers to self-propagating malware that spreads between systems without requiring a user to copy each instance. This could be appropriate elsewhere, but the required function is reuse of captured authentication data or tokens to impersonate a legitimate user or system; that makes Credential replay the precise choice.
Answer D is incorrect because Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed. The question is not asking for this function. It is testing reuse of captured authentication data or tokens to impersonate a legitimate user or system, so Credential replay is the stronger fit.
Question 6
To capture credentials or sensitive text entered by a user, which security approach should be selected?
- Concurrent session anomaly
- Virus
- Privilege escalation
- Keylogger
Correct Answer: D
Correct Answer
Answer D is correct because Keylogger means software or hardware that records keystrokes. The requirement maps directly to this function, whereas Virus is aimed at malware that attaches to a host file or other object and replicates when the infected host is executed.
Incorrect Answers
Answer A is incorrect because Concurrent session anomaly refers to unexpected simultaneous use of the same identity from different devices or locations. That concept can be valid in another scenario, but this question is testing software or hardware that records keystrokes; Keylogger therefore fits the requirement more directly.
Answer B is incorrect because Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed. The scenario instead requires software or hardware that records keystrokes, which is why Keylogger is the better answer; this option serves the different function defined above.
Answer C is incorrect because Privilege escalation refers to an attack that obtains permissions beyond those originally granted. The question is not asking for this function. It is testing software or hardware that records keystrokes, so Keylogger is the stronger fit.
Question 7
Which term describes self-propagating malware that spreads between systems without requiring a user to copy each instance?
- Worm
- Directory traversal
- Spyware
- Privilege escalation
Correct Answer: A
Correct Answer
Answer A is correct because Worm means self-propagating malware that spreads between systems without requiring a user to copy each instance. This matches the requirement as written. Privilege escalation can be valid in another context, but it is used for an attack that obtains permissions beyond those originally granted.
Incorrect Answers
Answer B is incorrect because Directory traversal refers to manipulation of path input to access files or directories outside an intended location. The scenario instead requires self-propagating malware that spreads between systems without requiring a user to copy each instance, which is why Worm is the better answer; this option serves the different function defined above.
Answer C is incorrect because Spyware refers to malware designed to covertly collect information about users or systems. The concept is valid, but it does not match this stem. The required function is self-propagating malware that spreads between systems without requiring a user to copy each instance, which maps to Worm.
Answer D is incorrect because Privilege escalation refers to an attack that obtains permissions beyond those originally granted. The concept is valid, but it does not match this stem. The required function is self-propagating malware that spreads between systems without requiring a user to copy each instance, which maps to Worm. This question specifically tests the requirement represented by Worm.
Question 8
To recognize stealthy persistence that manipulates or hides low-level system activity, which security approach should be selected?
- Directory traversal
- Rootkit
- DDoS reflection
- Trojan
Correct Answer: B
Correct Answer
Answer B is correct because Rootkit means malware designed to maintain privileged hidden access and conceal its presence. The requirement maps directly to this function, whereas DDoS reflection is aimed at a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing.
Incorrect Answers
Answer A is incorrect because Directory traversal refers to manipulation of path input to access files or directories outside an intended location. The key mismatch is functional: Rootkit addresses malware designed to maintain privileged hidden access and conceal its presence, the need stated by the question.
Answer C is incorrect because DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing. That concept can be valid in another scenario, but this question is testing malware designed to maintain privileged hidden access and conceal its presence; Rootkit therefore fits the requirement more directly.
Answer D is incorrect because Trojan refers to malware that appears legitimate or useful but contains hidden malicious functionality. This could be appropriate elsewhere, but the required function is malware designed to maintain privileged hidden access and conceal its presence; that makes Rootkit the precise choice.
Question 9
What is an attack in which an adversary positions itself between communicating parties to observe or alter traffic?
- Injection attack
- Rootkit
- Missing logs
- On-path attack
Correct Answer: D
Correct Answer
Answer D is correct because On-path attack means an attack in which an adversary positions itself between communicating parties to observe or alter traffic. The deciding point is functional fit: this option covers the stated need, while Injection attack addresses an application attack that causes untrusted input to be interpreted as commands, queries, or code.
Incorrect Answers
Answer A is incorrect because Injection attack refers to an application attack that causes untrusted input to be interpreted as commands, queries, or code. That concept can be valid in another scenario, but this question is testing an attack in which an adversary positions itself between communicating parties to observe or alter traffic; On-path attack therefore fits the requirement more directly.
Answer B is incorrect because Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence. That concept can be valid in another scenario, but this question is testing an attack in which an adversary positions itself between communicating parties to observe or alter traffic; On-path attack therefore fits the requirement more directly.
Answer C is incorrect because Missing logs refers to absence of expected telemetry or audit records. The key mismatch is functional: On-path attack addresses an attack in which an adversary positions itself between communicating parties to observe or alter traffic, the need stated by the question.
Question 10
An architect working on a SOC investigation of suspicious activity needs one capability that provides malicious code that remains dormant until a specific condition, event, or time triggers execution and another that provides reuse of captured authentication data or tokens to impersonate a legitimate user or system. Which TWO selections are the best match? Choose TWO.
- Logic bomb
- Privilege escalation
- Worm
- Keylogger
- Credential replay
Correct Answers: A, E
Correct Answers
Answer A is correct because Logic bomb means malicious code that remains dormant until a specific condition, event, or time triggers execution. This selection maps directly to one of the named needs. Privilege escalation addresses an attack that obtains permissions beyond those originally granted, so it does not satisfy the same slot.
Answer E is correct because Credential replay means reuse of captured authentication data or tokens to impersonate a legitimate user or system. This selection maps directly to one of the named needs. Privilege escalation addresses an attack that obtains permissions beyond those originally granted, so it does not satisfy the same slot.
Incorrect Answers
Answer B is incorrect because Privilege escalation means an attack that obtains permissions beyond those originally granted. The required choices are Logic bomb, Credential replay. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer C is incorrect because Worm means self-propagating malware that spreads between systems without requiring a user to copy each instance. The question requires exactly 2 selections: Logic bomb, Credential replay. This option falls outside that required set. For example, Logic bomb is required for malicious code that remains dormant until a specific condition, event, or time triggers execution.
Answer D is incorrect because Keylogger means software or hardware that records keystrokes. The required choices are Logic bomb, Credential replay. Although this option is security-relevant, it does not satisfy one of the functions named in the stem. For example, Logic bomb is required for malicious code that remains dormant until a specific condition, event, or time triggers execution.
Question 11
A security engineer is working through a SOC investigation of suspicious activity. The immediate requirement is malicious code that remains dormant until a specific condition, event, or time triggers execution. Which choice is the best fit?
- Impossible travel
- Password brute force
- RFID cloning
- Logic bomb
Correct Answer: D
Correct Answer
Answer D is correct because Logic bomb means malicious code that remains dormant until a specific condition, event, or time triggers execution. This matches the requirement as written. Impossible travel can be valid in another context, but it is used for an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time.
Incorrect Answers
Answer A is incorrect because Impossible travel means an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time. The key mismatch is functional: Logic bomb addresses malicious code that remains dormant until a specific condition, event, or time triggers execution, the need stated by the question.
Answer B is incorrect because Password brute force means systematically trying many password candidates against an account or captured hash. The concept is valid, but it does not match this stem. The required function is malicious code that remains dormant until a specific condition, event, or time triggers execution, which maps to Logic bomb.
Answer C is incorrect because RFID cloning means copying or emulating data from an RFID credential. This could be appropriate elsewhere, but the required function is malicious code that remains dormant until a specific condition, event, or time triggers execution; that makes Logic bomb the precise choice.
Question 12
Reviewers working through a SOC investigation of suspicious activity identify three separate needs: software or hardware that records keystrokes; denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim; attack that obtains permissions beyond those originally granted. Which THREE choices map to those needs? Choose THREE.
- Worm
- Impossible travel
- Privilege escalation
- Keylogger
- Injection attack
- DDoS amplification
Correct Answers: C, D, F
Correct Answers
Answer C is correct because Privilege escalation means an attack that obtains permissions beyond those originally granted. The fixed-count item needs this function in the answer set. Impossible travel covers an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time, a different requirement.
Answer D is correct because Keylogger means software or hardware that records keystrokes. It belongs in the fixed-count answer set because it covers one of the stated requirements. Injection attack instead serves an application attack that causes untrusted input to be interpreted as commands, queries, or code and cannot replace this function.
Answer F is correct because DDoS amplification means a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. This option satisfies a specific requirement in the stem; Worm serves self-propagating malware that spreads between systems without requiring a user to copy each instance and therefore is not interchangeable with it.
Incorrect Answers
Answer A is incorrect because Worm means self-propagating malware that spreads between systems without requiring a user to copy each instance. The required choices are Keylogger, DDoS amplification, Privilege escalation. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer B is incorrect because Impossible travel means an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time. The question requires exactly 3 selections: Keylogger, DDoS amplification, Privilege escalation. This option falls outside that required set.
Answer E is incorrect because Injection attack means an application attack that causes untrusted input to be interpreted as commands, queries, or code. The scenario calls for Keylogger, DDoS amplification, Privilege escalation. Selecting this option would leave one of those required functions uncovered.
Question 13
To identify delayed malicious behavior tied to a trigger, which security approach should be selected?
- DDoS amplification
- Credential replay
- Logic bomb
- Out-of-cycle logging
Correct Answer: C
Correct Answer
Answer C is correct because Logic bomb means malicious code that remains dormant until a specific condition, event, or time triggers execution. The deciding point is functional fit: this option covers the stated need, while DDoS amplification addresses a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.
Incorrect Answers
Answer A is incorrect because DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. The question is not asking for this function. It is testing malicious code that remains dormant until a specific condition, event, or time triggers execution, so Logic bomb is the stronger fit.
Answer B is incorrect because Credential replay refers to reuse of captured authentication data or tokens to impersonate a legitimate user or system. The question is not asking for this function. It is testing malicious code that remains dormant until a specific condition, event, or time triggers execution, so Logic bomb is the stronger fit.
Answer D is incorrect because Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns. This could be appropriate elsewhere, but the required function is malicious code that remains dormant until a specific condition, event, or time triggers execution; that makes Logic bomb the precise choice.
Question 14
Two requirements remain open in a SOC investigation of suspicious activity: software or hardware that records keystrokes; unexpected simultaneous use of the same identity from different devices or locations. Which TWO options close those specific gaps? Choose TWO.
- DDoS amplification
- Concurrent session anomaly
- RFID cloning
- Keylogger
- On-path attack
Correct Answers: B, D
Correct Answers
Answer B is correct because Concurrent session anomaly means unexpected simultaneous use of the same identity from different devices or locations. This option satisfies a specific requirement in the stem; On-path attack serves an attack in which an adversary positions itself between communicating parties to observe or alter traffic and therefore is not interchangeable with it.
Answer D is correct because Keylogger means software or hardware that records keystrokes. This option satisfies a specific requirement in the stem; DDoS amplification serves a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim and therefore is not interchangeable with it.
Incorrect Answers
Answer A is incorrect because DDoS amplification means a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. The fixed-count answer set is Concurrent session anomaly, Keylogger; this option does not fill one of those named functions.
Answer C is incorrect because RFID cloning means copying or emulating data from an RFID credential. Every answer slot must map to a stated requirement. The correct set is Concurrent session anomaly, Keylogger, so this option cannot replace one of those selections.
Answer E is incorrect because On-path attack means an attack in which an adversary positions itself between communicating parties to observe or alter traffic. The scenario calls for Concurrent session anomaly, Keylogger. Selecting this option would leave one of those required functions uncovered.
Question 15
Which term describes malware that appears legitimate or useful but contains hidden malicious functionality?
- DNS attack
- Virus
- Directory traversal
- Trojan
Correct Answer: D
Correct Answer
Answer D is correct because Trojan means malware that appears legitimate or useful but contains hidden malicious functionality. The requirement maps directly to this function, whereas Directory traversal is aimed at manipulation of path input to access files or directories outside an intended location.
Incorrect Answers
Answer A is incorrect because DNS attack refers to malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure. The key mismatch is functional: Trojan addresses malware that appears legitimate or useful but contains hidden malicious functionality, the need stated by the question.
Answer B is incorrect because Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed. This could be appropriate elsewhere, but the required function is malware that appears legitimate or useful but contains hidden malicious functionality; that makes Trojan the precise choice.
Answer C is incorrect because Directory traversal refers to manipulation of path input to access files or directories outside an intended location. The question is not asking for this function. It is testing malware that appears legitimate or useful but contains hidden malicious functionality, so Trojan is the stronger fit.
Question 16
An architect working on a SOC investigation of suspicious activity needs one capability that provides malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession and another that provides malware that appears legitimate or useful but contains hidden malicious functionality. Which TWO selections are the best match? Choose TWO.
- Rootkit
- Trojan
- Collision attack
- Logic bomb
- Ransomware
Correct Answers: B, E
Correct Answers
Answer B is correct because Trojan means malware that appears legitimate or useful but contains hidden malicious functionality. This selection maps directly to one of the named needs. Collision attack addresses an attack that seeks two different inputs producing the same hash value, so it does not satisfy the same slot.
Answer E is correct because Ransomware means malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. It belongs in the fixed-count answer set because it covers one of the stated requirements. Collision attack instead serves an attack that seeks two different inputs producing the same hash value and cannot replace this function. This question specifically tests the combined requirements represented by Trojan and Ransomware.
Incorrect Answers
Answer A is incorrect because Rootkit means malware designed to maintain privileged hidden access and conceal its presence. The question requires exactly 2 selections: Trojan, Ransomware. This option falls outside that required set. For example, Trojan is required for malware that appears legitimate or useful but contains hidden malicious functionality.
Answer C is incorrect because Collision attack means an attack that seeks two different inputs producing the same hash value. The required choices are Trojan, Ransomware. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer D is incorrect because Logic bomb means malicious code that remains dormant until a specific condition, event, or time triggers execution. The fixed-count answer set is Trojan, Ransomware; this option does not fill one of those named functions.
Question 17
A review during a SOC investigation of suspicious activity identifies two gaps. One requires self-propagating malware that spreads between systems without requiring a user to copy each instance. The other requires probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. Which TWO options should be included in the remediation plan? Choose TWO.
- Missing logs
- Out-of-cycle logging
- Worm
- Birthday attack
- Keylogger
Correct Answers: C, D
Correct Answers
Answer C is correct because Worm means self-propagating malware that spreads between systems without requiring a user to copy each instance. It belongs in the fixed-count answer set because it covers one of the stated requirements. Out-of-cycle logging instead serves security-relevant activity recorded at an unusual time compared with normal operational patterns and cannot replace this function.
Answer D is correct because Birthday attack means a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. This selection maps directly to one of the named needs. Out-of-cycle logging addresses security-relevant activity recorded at an unusual time compared with normal operational patterns, so it does not satisfy the same slot.
Incorrect Answers
Answer A is incorrect because Missing logs means absence of expected telemetry or audit records. The fixed-count answer set is Worm, Birthday attack; this option does not fill one of those named functions. For example, Birthday attack is required for a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.
Answer B is incorrect because Out-of-cycle logging means security-relevant activity recorded at an unusual time compared with normal operational patterns. The required choices are Worm, Birthday attack. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer E is incorrect because Keylogger means software or hardware that records keystrokes. The required choices are Worm, Birthday attack. Although this option is security-relevant, it does not satisfy one of the functions named in the stem. For example, Birthday attack is required for a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.
Question 18
As part of a SOC investigation of suspicious activity, reviewers identify a need for malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. Which option should they select?
- Concurrent session anomaly
- Ransomware
- Credential replay
- Rootkit
Correct Answer: B
Correct Answer
Answer B is correct because Ransomware means malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. That makes it the best answer here; Credential replay addresses reuse of captured authentication data or tokens to impersonate a legitimate user or system, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Concurrent session anomaly means unexpected simultaneous use of the same identity from different devices or locations. The scenario instead requires malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession, which is why Ransomware is the better answer; this option serves the different function defined above.
Answer C is incorrect because Credential replay means reuse of captured authentication data or tokens to impersonate a legitimate user or system. The key mismatch is functional: Ransomware addresses malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession, the need stated by the question.
Answer D is incorrect because Rootkit means malware designed to maintain privileged hidden access and conceal its presence. That concept can be valid in another scenario, but this question is testing malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession; Ransomware therefore fits the requirement more directly.
Question 19
Which term describes malware designed to covertly collect information about users or systems?
- Spyware
- Out-of-cycle logging
- DDoS amplification
- DNS attack
Correct Answer: A
Correct Answer
Answer A is correct because Spyware means malware designed to covertly collect information about users or systems. This matches the requirement as written. DDoS amplification can be valid in another context, but it is used for a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.
Incorrect Answers
Answer B is incorrect because Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns. The scenario instead requires malware designed to covertly collect information about users or systems, which is why Spyware is the better answer; this option serves the different function defined above.
Answer C is incorrect because DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. This could be appropriate elsewhere, but the required function is malware designed to covertly collect information about users or systems; that makes Spyware the precise choice.
Answer D is incorrect because DNS attack refers to malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure. That concept can be valid in another scenario, but this question is testing malware designed to covertly collect information about users or systems; Spyware therefore fits the requirement more directly.
Question 20
To detect unauthorized monitoring and data collection, which security approach should be selected?
- Worm
- Spyware
- DDoS amplification
- Missing logs
Correct Answer: B
Correct Answer
Answer B is correct because Spyware means malware designed to covertly collect information about users or systems. The requirement maps directly to this function, whereas Worm is aimed at self-propagating malware that spreads between systems without requiring a user to copy each instance.
Incorrect Answers
Answer A is incorrect because Worm refers to self-propagating malware that spreads between systems without requiring a user to copy each instance. The question is not asking for this function. It is testing malware designed to covertly collect information about users or systems, so Spyware is the stronger fit.
Answer C is incorrect because DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. That concept can be valid in another scenario, but this question is testing malware designed to covertly collect information about users or systems; Spyware therefore fits the requirement more directly.
Answer D is incorrect because Missing logs refers to absence of expected telemetry or audit records. This could be appropriate elsewhere, but the required function is malware designed to covertly collect information about users or systems; that makes Spyware the precise choice.
