(Select the two best answer choices) A. A program that performs a malicious activity at a specific time or after triggering an event. This way, when the kernel enumerates processes by following the links, it won't see that . What this means is that the rootkit can effectively add new code to the OS, or even delete and replace OS code. They are thus also much easier to detect and remove than any other rootkits. Explanation: Weak or non-existent mechanisms for authentication is an example of session layer vulnerability. Rootkit 5. Answer: a. Answer (1 of 6): Depends on the type of malware. Malformation or other known malware traits. The rootkit must store code in a persistent store, such as the registry or file system, and configure a method by which the code executes without user intervention. You configure the software to quarantine any files with problems. b) Understands the process of exploiting network vulnerabilities. There are four broadcast domains in the network. . Which of the following is true of a DDoS attack? So far, we have shown only how to craft raw packets from a user-mode program. A. Domain name kiting B. A rootkit can be classified using the following characteristics: Persistent: Activates each time the system boots. Botnets are used to perform distributed . During that time, it can steal data or resources . The rootkit swaps pointers of the two objects neighboring its own process. Integrity-Based Detection. Rootkits are similar to Trojans in that they serve as a backdoor to introduce more malware to the computer. This rootkit allows us to hide files and processes and creates a backdoor on the machine that has it. (Choose two.) What is the purpose of a Denial of Service attack? 83. Blended threat: A malware package that combines the characteristics of multiple kinds of the malicious program like Trojans, viruses worms, seeking to exploit more than one system vulnerability. Question: Which two characteristics describe a worm? What is the API vulnerability revealed in . While testing, he found a vulnerability that allows hackers to gain unauthorized access to API objects and perform actions such as view, update, and delete sensitive data of the company. The Correct Answer for this Question is. Integrity-based detection is a substitute to both signature- and heuristic-based detection. D) deleting an infected file. (Choose two.) A. Library level rootkits B. Kernel level rootkits C. System level rootkits D. Application level rootkits. The URL is correct and the website is displayed in the browser, but the user gets an SSL warning that the SSL certificate is invalid as it is signed by an unknown authority. on a clean system. Worm. A rootkit is a set of programs that allow attackers to maintain hidden, permanent, administrator-level access to a computer. d) Has the highest level of security for the organization. You've created a message to send to another user. Deception, social engineering. Attackers use rootkits to hide malware on a device in a way that allows it to persist undetected over time, sometimes for years. In Windows NT 5.x all processes active in the system are linked in a single bidirectional list. Autostart or other system reconfiguration. In the previous two parts of this series on the Necurs rootkit [ 1 ], [ 2 ], we looked at what it does to hook the system. Which of the following is not a typical characteristic of an ethical hacker? Trojan. Which of the following is not a typical characteristic of an ethical hacker? More about these Exams , By definition, which security concept uses the ability to prove that a sender undeniably sent an encrypted message? QUESTION 36 A user visits their normal banking website. FOLLOW This time, we will look at what those . Which two characteristics describe a worm? The term rootkit is a compound of "root" (the traditional name of the privileged account on Unix-like operating systems) and . Trojans impersonate . (choose all that apply) Can be vulnerable to denial of . A rootkit is a program or a collection of malicious software tools that give a threat actor remote access to and control over a computer or other system. Which of the following attacks come under the category of. hides in a dormant state until needed by an attacker. User mode rootkits are the furthest from the core of your computer and affect only target the software on your PC. Pages 160 ; Ratings 100% (6) 6 out of 6 people found this document helpful; This preview shows page 7 - 10 out of 160 pages.preview shows page 7 - 10 out of 160 pages. Following are the rootkit detection techniques: signature, heuristic, integrity, cross view-based, and runtime execution path profiling. ITC Chapter 2 Quiz Answers Which two characteristics describe a worm? Uses multicast addressesQuestion. Appropriately named after the Iliad 's famed Trojan Horse, the malware called Trojans disguises itself as desirable software and tricks users into downloading it. , Your computer system is a participant in an asymmetric cryptography system. In connection flooding, the attacker floods the victim network with a huge number of connections, so that, no other machine can connect to it. >>Asynchronous attack Trojan horse DNS poisoning You have installed anti-malware software that checks for viruses in email attachments. executes when software is run on a computer. B. Rootkit. The Question - Which of the following security threats is defined by its self propagating characteristic? Developed as a legitimate software to provide a 'backdoor' to software developers in order to fix the respective software - in case any . A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the existence of other software. Correct Answer The Correct Answer for this Question is Rootkit Explanation The Question - Which of the following security threats is defined by its self propagating characteristic? Join us as we pull back the curtain of various types of rootkit malware, and learn about the attack vectors and the prevention measures. Privilege escalation C. Replay attack D. Man-in-the-middle attack Correct Answer: A worm can execute independently of the host system. A worm can replicate itself, while a virus requires a host for distribution. In part 3, he takes a look at what those hooks actually do. Hijack, redirection, or data theft. . Rootkits hide perfectly from most virus scanners and security solutions, meaning the user may never know they exist. A (n) ________ is the portion of virus code that is unique to a particular computer virus. has been answered correctly and answers for the question is Rootkit. (2) Hides itself from detection, requires admin-level privileges for installation. Kernel rootkit. Question 7. a) weak or non-existent mechanisms for authentication. Integrity-Based Detection. Sysinternals' Mark Russinovich has performed an analysis of the copy restriction measures deployed by Sony Music on its latest CDs: which he bluntly calls a 'root kit'. You have heard about a new malware program that prevents itself to users as a virus scanner. As mentioned above, the rootkit builds table of ntoskrnl exports that stores pointers to functions and hashes of names. It has following charactaristics. (select two) Requires administrator-level privileges for installation, Hides itself from detection 6. The Question - Which of the following security threats is defined by its self propagating characteristic? Once an attacker has access to an infected computer, it is possible for the . d. You have heard about a new malware program that presents itself to users as a virus scanner. Explanation. A worm tries to gather information, while a virus tries to destroy data. 12. c) patience, persistence and perseverance. Describe a logic bomb. The following signs on your device might indicate the presence of a rootkit. In other words, a software kit used to gain admin access to the computer and thereby control it. It is vulnerable to DDoS attacks. A Trojan horse, commonly known as a "Trojan," is a type of malware that disguises itself as a normal file or program to trick users into downloading and installing malware. Initially, the attacker runs tools such as Tripware, AIDE, etc. Malware is Malicious Software Malware can be anything from Adware which just spams ads to you, Spyware which collects data or even Ransomware which will encrypt your data in exchange for money This makes it a more advanced type of malware that proves to be one of the most difficult to detect and remove. C. A rootkit is a set of programs installed on a system to maintain covert access to that system with administrator (or root)3 privileges, while hiding evidence of its presence to the greatest extent possible. Q13. Question 63: A hybrid virus infects both files and system sectors and may incorporate which of the following? What type of rootkit will patch, hook, or replace the version of system call in order to hide information? In fact it is used to launch the DDoS attacks called as amplification attack. The following methods are used by hackers to avoid detection:Encryption and tunneling - hide or scramble the malware content Resource exhaustion - keep the host device too busy to detect the invasion Traffic fragmentation - split the malware into multiple packets Protocol-level misinterpretation - sneak by the firewall Rootkit developers, wanting the best of both worlds, developed a hybrid rootkit that combines user-mode characteristics (easy to use and stable) with kernel-mode characteristics (stealthy). a) Excellent knowledge of windows. Explanation: Worm malware can execute and copy itself without being triggered by a host program. Rootkits can be classified in accordance with the following characteristics: Persistence: A persistent rootkit is one that is activated every time the system starts up. Which of the following are characteristics of a rootkit? Which of the following has occurred? Firmware rootkits are the next step in sophistication. $$ U = \left\{ {u_{1} ,u_{2} , \ldots u_{n} } \right\} $$ (1) Among them, \( u_{i} \) expresses a behavior characteristic of Rootkit. Ans. . Commonly referred to as application rootkits, they replace the executable files of standard programs like Word, Excel, Paint, or Notepad. B) placing a found virus in a secure area on the hard drive. 1. Simple Service Discovery protocol is the basis protocol which is used to discover services in small network environments for Universal Plug and Play service. 83. Excellent knowledge of Windows. Process, service, or memory object change. Virus Rootkit Trojan Worm Correct Answer The Correct Answer for this Question is Rootkit Explanation The Question - Which of the following security threats is defined by its self propagating characteristic? A behavior characteristic can appear in Rootkit or . Question 20) Which of the following characteristics applies to the Simple Service Discovery Protocol (SSDP)? Which command should the administrator use to shred the data? File drop, download, sharing, or replication. By Susan Bradley. Rootkit Which of the following are characteristics of a rootkit? Rootkit which of the folowing are characteristics of a rootkit (Select two.) For Windows XP we will use a rootkit called Hacker Defender. Trojan horse. Changes in your settings and . Rootkits can prevent a harmful process from being visible in the system's list of processes, or keep its files from being read. Rootkit. travels to new computers without any intervention or knowledge of the user. A rootkit is a collection of tools that, once installed, attackers can use to create backdoors in a victim's system and introduce other types of malware to the network for further attacks. If a biometric characteristic, like your fingerprints, is compromised, your . - A program that performs a malicious activity at a specific time or after a triggering event. It uses some new techniques including not only putting itself in a ADS (NTFS alternate data stream) which isn't seen by normal file system enumeration tools, but even blocks ADS aware tools from seeing the stream. Which of the following choices would have most likely prevented the incident? The WP bit will need to be set and reset at multiple points in the code, so it makes programmatic sense to abstract the operations. CHARACTERISTICS OF A VIRUS: viruses are extremely well adapted to their host organism, virus structure varies greatly. In simple language, 'rootkit' is basically a software kit used to get to the root of the computer. This is fine for experiments, but when it comes to creating a real-world rootkit, you must be able to send and receive raw packets from the kernel. infects computers by attaching to software code. Characteristics are grouped into the following categories: Anti-security, self-preservation Autostart or other system reconfiguration Deception, social engineering File drop, download, sharing, or replication Hijack, redirection, or data theft Malformation or other known malware traits Process, service, or memory object change Rootkit, cloaking Which of the following attacks are examples of Denial-of-service attacks (DoS)? a. 1. Question: Which two characteristics describe a worm? You receive an email with an important attachment, but the attachment is not there. d) highly complex application security controls. n is the total number of behavior characteristics in the behavior feature library. The capsid is made of proteins and glycoproteins. C) repairing an infected file. Trojans. A collection of zombie computers have been set up to collect personal information. There are two broadcast domains in the network. Once malicious software is installed on a system, it is essential that it stays concealed, to avoid detection. In this section, we'll go through kernel rootkits, hardware & software rootkits, Hyper-V, and more. However, there are some general structural characteristics that all viruses share. This type of rootkit is designed to function at the level of the operating system itself. - A type of malicious code similar to a virus whose primary purpose is to duplicate itself and spread, while not necessarily intentionally damaging or destroying resources. has been answered correctly and answers for the question is Rootkit. Following are the rootkit detection techniques: signature, heuristic, integrity, cross view-based, and runtime execution path profiling. To do so, it must store its code in some way within the computer, and must also have some way to automatically start itself up. A) virus signature. A rootkit is software that gives malicious actors remote control of a victim's computer with full administrative privileges. Requires administrator-level privileges for installation Hides itself from detection You have heard about a new malware program that presents itself to users as a virus scanner. The hybrid approach is very successful and the most popular rootkit at this time. hides in a dormant state until needed by an attacker. Given this, rootkits are usually designed to avoid detection and can be difficult to detect. on a clean system. Andrew Orlowski Tue 1 Nov 2005 // 10:25 UTC. Characteristics are grouped into the following categories: Anti-security, self-preservation. Next characteristics show inarticulate logic of rootkit work. (Choose two.) Which of the following security policies is the company using during this entire process to mitigate the risk of hacking attacks? IPS - A rootkit is a set of software tools that enable an unauthorized user to gain controls of a computer system without being detected. Rootkits that modify system's kernel object queue can hide processes as follows. a) 5 b) 7 c) 10 d) 12 Answer: c Explanation: There are a total of 10 types of virus. 3. d. Kerel level focuses on replaceing specific code while application level will concentrate on . The rootkit wars have started to escalate with a rootkit named Rustock which is able to remain hidden from all the popular anti-rootkit tools. Many instances of malware fit into multiple categories: for instance, Stuxnet is a worm, a virus and a rootkit. Although this type of software has some legitimate uses, such as providing remote end-user support, most rootkits open a backdoor on victims' systems to introduce malicious software . More Questions: CCNA Cyber Ops (v1.1) - Chapter 6 Exam Answers. . hides in a dormant state until needed by an attacker. executes when software is run on a computer. Which of the following includes all hardware and software necessary to secure data, such as firewalls and antivirus software? b) Understands the process of exploiting network vulnerabilities. This provides access to all the functions and services of the operating system. The second one is a kernel level rootkit named Knark. exe, bat, doc, or txt. Reverse engineering will give access to precise information regarding these characteristics of a rootkit, often within a matter of hours. Originally, within the context of UNIX-type systems, a rootkit was a group of tools belonging to the operating system itself, such as netstat, passwd and ps, which were modified by an intruder in order to gain unlimited access to the target computer, without this intrusion being detected by the system administrator. Rootkits can be injected into applications, kernels, hypervisors, or firmware. c) poor handling of unexpected input. B. A worm is restricted to one system, while a virus can spread from system to system. hides in a dormant state until needed by an attacker executes when software is run on a computer travels to new computers without any intervention or knowledge of the user infects computers by attaching to software code is self-replicating Explanation: Worms are []Continue reading. More about these Exams c) patience, persistence and perseverance. A. Integrity-based detection is a substitute to both signature- and heuristic-based detection. Other Important Terms . d) Has the highest level of security for the organization. There are _____ types of computer virus. Ans. A. Characteristics of macro viruses 28. While NDIS Which of the following is not a typical characteristic of an ethical hacker? In the first and second parts of his series on the Necurs rootkit, Peter Ferrie looked at what it does to hook the system. It is a significant network and Internet security threat. (Choose two.) 8. A Trojan can give a malicious party remote access to an infected computer. Rootkit. Explanation. Using conventional tools to remove Sony's digital media malware will leave ordinary users with Windows systems unable to play CDs. Firmware rootkits. A rootkit: > Is almost invisible software. A . All viruses have a capsid or head region that contains its genetic material. executes when software is run on a computer. We will also look at four ways of seeing if a rootkit is installed, by using kern_check, chkrootkit, strace and Rootkit Hunter. It is considered by many to be more dangerous because it embeds itself very deeply into the user's system. Botnet: A number of Internet-connected devices that are running one or more bots. A key characteristic of rootkits is that they tend not to provide any clues that they have infiltrated the system. Correct Answer. The behavioral characteristics of Rootkit can be expressed in a collection. What are the characteristics of a rootkit? Software packages known as rootkits allow this concealment, by modifying the host's operating system so that the malware is hidden from the user. travels to new computers without any intervention or knowledge of the user. A rootkit is designed to provide administrator-level access to a third party without the system owner's knowledge. Trojan Horse. Which of the following statements most accurately describes the characteristics of the above networks broadcast and collision domains? has been answered correctly and answers for the question is Rootkit More about these Exams Initially, the attacker runs tools such as Tripware, AIDE, etc. B. B) encryption code. A. Library level rootkits B. Kernel level rootkits C. System level rootkits D. Application level rootkits Correct Answer - A Explanation - Library leve rootkits is the correct answer. 1. 281.651.2254 sales@securenetworkers.com Facebook A company determined that its web site was compromised and a rootkit was installed on the server hosting the application. Rootkits have two primary functions: remote command/control (back door) and software eavesdropping. has been answered correctly and answers for the question is Rootkit More about these Exams This article will explore the key concepts associated with rootkits and reverse engineering, including types of rootkits and common techniques used by rootkits, like hooking and exploitation of interrupts. Chapter 2 Quiz Answers. C) compression code. Which of the following is not a common file extension type that should be restricted or blocked as an email attachment due to its likelihood to contain or host a virus? For example, created by rootkit table of ntoskrnl exports is used only in one case, when the rootkit receives special IOCTL code. attacker floods the victim with a huge flow of packets and uses up all the bandwidth. Understands the process of exploiting network vulnerabilities. infects computers by attaching to software code. is self-replicating. Ron, a security professional, was pen testing web applications and SaaS platforms used by his company. This . a) Excellent knowledge of windows. is self-replicating. b) overloading of transport-layer mechanisms. The following code originates from the PaX project, specifically from the native_pax_open_kernel() and native_pax_close_kernel() routines.Extra caution is taken to prevent a potential race condition caused by unlucky scheduling on SMP systems, as explained in a . Rootkits allow someone, legitimate or otherwise, to administratively control a computer. Using the NDIS interface allows a driver access to raw packets. Boot loader-level rootkit Hypervisor-level rootkit Library-level rootkit Kernel-level rootkit Question 29) What is the first step in the vulnerability management life cycle? Rootkits. A) updating your antivirus software. .