Certified Ethical Hacker System Hacking and Malware 1 — Questions and Answers
Question 1: What is privilege escalation and what are the two types?
- Gaining higher access rights than authorized; vertical (user to admin) and horizontal (accessing another user's resources) (Correct answer)
- Climbing the corporate hierarchy
- Increasing network bandwidth privileges
- Upgrading software to premium versions
Correct answer: Gaining higher access rights than authorized; vertical (user to admin) and horizontal (accessing another user's resources)
Privilege escalation exploits vulnerabilities to gain elevated access. Vertical escalation moves from lower to higher privileges (user to root/admin), while horizontal accesses resources of another user with similar privileges.
Question 2: What is a rootkit and why is it particularly dangerous?
- Malware that hides deep in the OS to maintain persistent, undetectable access (Correct answer)
- A toolkit for root vegetables
- A legitimate system administration tool
- A type of firewall software
Correct answer: Malware that hides deep in the OS to maintain persistent, undetectable access
Rootkits operate at kernel or firmware level, modifying the OS to hide their presence (hiding files, processes, network connections) from detection tools, providing persistent backdoor access that survives reboots.
Question 3: What is the difference between a virus, worm, and Trojan?
- Viruses attach to files and need user action; worms self-replicate across networks; Trojans disguise as legitimate software (Correct answer)
- They are all the same type of malware
- Worms require user action while viruses don't
- Trojans self-replicate but viruses don't
Correct answer: Viruses attach to files and need user action; worms self-replicate across networks; Trojans disguise as legitimate software
Viruses attach to host files and require user action to spread, worms self-propagate across networks without user interaction, and Trojans appear legitimate but contain hidden malicious functionality.
Question 4: What is a keylogger and how can it be detected?
- Software or hardware that records keystrokes; detected through antimalware, process monitoring, and physical inspection (Correct answer)
- A tool for logging into key management systems
- A password manager application
- A type of keyboard with built-in logging
Correct answer: Software or hardware that records keystrokes; detected through antimalware, process monitoring, and physical inspection
Keyloggers capture every keystroke typed on a system, either through software (running as a hidden process) or hardware (a device between the keyboard and computer), stealing passwords and sensitive data.
Question 5: What are common password cracking techniques?
- Dictionary attacks, brute force, rule-based attacks, rainbow tables, and credential stuffing (Correct answer)
- Only guessing common passwords
- Only using social engineering
- Only using brute force
Correct answer: Dictionary attacks, brute force, rule-based attacks, rainbow tables, and credential stuffing
Password cracking employs multiple techniques: dictionary attacks (common words), brute force (all combinations), rule-based (dictionary with modifications), rainbow tables (precomputed hashes), and credential stuffing (reusing leaked credentials).
Question 6: What is fileless malware and why is it difficult to detect?
- Malware that operates entirely in memory without writing files to disk, evading traditional file-based scanning (Correct answer)
- Malware with no file size
- Malware that deletes all files on a system
- Malware that only affects file servers
Correct answer: Malware that operates entirely in memory without writing files to disk, evading traditional file-based scanning
Fileless malware executes entirely in RAM using legitimate system tools (PowerShell, WMI, macros), leaving no traditional file artifacts on disk, making it invisible to conventional antivirus that scans files.
Certified Ethical Hacker System Hacking and Malware 1
What is privilege escalation and what are the two types?