Malware and Attack Types

1. What is "credential stuffing"?

• A. Creating fake credentials
• B. Using stolen username/password combinations from one breach to access accounts on other services ✓
• C. A brute force attack
• D. A type of phishing

💡 Credential stuffing uses leaked credential lists from data breaches to attempt logins on multiple services, exploiting password reuse.

2. What is "polymorphic malware"?

• A. Malware that attacks multiple systems
• B. Malware that constantly changes its code to evade signature-based detection ✓
• C. A type of ransomware only
• D. Malware targeting multiple users

💡 Polymorphic malware mutates its code each time it replicates, making it difficult for signature-based antivirus to detect.

3. What is "living off the land" (LotL) in cybersecurity?

• A. A sustainable IT strategy
• B. Using legitimate built-in system tools for malicious purposes to avoid detection ✓
• C. A type of malware
• D. A network attack strategy

💡 LotL attacks use legitimate system tools (PowerShell, WMI) for malicious purposes, making detection harder as no new malware is introduced.

4. What is a "logic bomb"?

• A. A physical explosive device
• B. Malicious code that executes when specific conditions are met ✓
• C. A type of ransomware
• D. A network attack tool

💡 A logic bomb is dormant malicious code that activates when triggered by specific conditions like a date, time, or user action.

5. What is an "exploit kit"?

• A. A security testing toolkit
• B. A collection of exploits packaged to automatically attack known vulnerabilities in browsers and plugins ✓
• C. A penetration testing tool
• D. A type of antivirus

💡 Exploit kits (like Angler, Blackhole) are malicious toolkits that automatically probe visitor systems for vulnerabilities and deliver malware.

6. What is "typosquatting"?

• A. A type of SQL injection
• B. Registering domain names similar to popular sites to catch users who mistype URLs ✓
• C. A type of DDoS attack
• D. A password attack

💡 Typosquatting registers misspelled versions of popular domains (gooogle.com) to capture traffic from users who make typing errors.

7. What is a "watering hole attack"?

• A. An attack on water infrastructure
• B. Compromising websites frequently visited by a target group to infect their devices ✓
• C. A type of phishing
• D. A network flooding attack

💡 Watering hole attacks compromise websites that target groups regularly visit, infecting visitors when they browse the site.

8. What is a "zero-day exploit"?

• A. A very old vulnerability
• B. An attack exploiting a vulnerability unknown to the vendor with no patch available ✓
• C. A minor software bug
• D. A patched vulnerability

💡 Zero-day exploits target unknown vulnerabilities — developers have zero days to prepare a patch before the attack occurs.

9. What is "fileless malware"?

• A. Malware stored in files
• B. Malware that operates entirely in memory without writing to disk, making it hard to detect ✓
• C. A type of ransomware
• D. Malware deleted after use

💡 Fileless malware runs entirely in RAM using legitimate system tools (PowerShell), leaving no files for antivirus to scan.

10. What is "whaling" in cybersecurity?

• A. A type of network attack
• B. A phishing attack specifically targeting high-profile executives or senior officials ✓
• C. A DDoS attack on large targets
• D. A type of malware

💡 Whaling targets high-value individuals (CEOs, CFOs) with sophisticated, personalized phishing attacks for maximum financial or data gain.

11. What is a "rootkit"?

• A. A type of antivirus
• B. Malware that provides persistent privileged access while hiding its presence on a system ✓
• C. A type of firewall
• D. A password cracking tool

💡 A rootkit hides itself and other malware deep in the OS, maintaining persistent privileged access while evading detection.

12. What is "cryptojacking"?

• A. Legal cryptocurrency mining
• B. Secretly using someone's computing resources to mine cryptocurrency without their knowledge ✓
• C. A type of ransomware
• D. Stealing cryptocurrency wallets

💡 Cryptojacking hijacks a victim's CPU/GPU resources to mine cryptocurrency for the attacker, slowing the victim's device.

13. What is "spear phishing"?

• A. A generic phishing email
• B. A highly targeted phishing attack customized for a specific individual or organization ✓
• C. A type of DDoS attack
• D. A network attack

💡 Spear phishing targets specific individuals using personalized information to make the deceptive email more convincing.

14. What is "drive-by download"?

• A. Downloading software intentionally
• B. Malware automatically downloaded and installed when a user visits a compromised website ✓
• C. A type of social engineering
• D. A manual malware installation

💡 Drive-by downloads install malware automatically when a user visits a compromised or malicious website, without any user interaction.

15. What does "C2" or "Command and Control" mean in malware?

• A. A type of two-factor authentication
• B. The infrastructure attackers use to communicate with and control compromised systems ✓
• C. A security framework
• D. A network protocol

💡 C2 infrastructure allows attackers to send commands to infected systems and receive stolen data from malware they have deployed.