AP Cybersecurity Drill 16: Identifying Malware by Behavior

Question 1. Based on the table, which item spread without the user opening anything?

• A) Program 3, because it ran only after its macro file had been opened
• B) Program 1, because it propagated across the network entirely on its own ✓
• C) Program 4, because it encrypted the files and then demanded a payment
• D) Program 2, because it was bundled inside a game the user chose to install

Explanation: Choice B is correct. Program 1 is described as spreading to other machines by itself with no file being opened, which is exactly the self-propagating pattern the question asks about. Choice A is incorrect. Program 3 runs only when its host file is opened, so it does require user action. Choice C is incorrect. Program 4's behavior is encryption for ransom, which the table does not tie to self-spreading. Choice D is incorrect. Program 2 arrived through a user-initiated install, not on its own.

Question 2. Which malware class best matches Program 2's behavior?

• A) A worm, since it can copy itself to reach other networked devices
• B) A virus, since it inserts its code into a separate host file
• C) Ransomware, since it locks data until a payment is delivered
• D) A trojan, since it hides inside software the user chose to run ✓

Explanation: Choice D is correct. Program 2 looks like a normal game but secretly opens a remote connection, which is the defining disguise-and-deceive pattern of a trojan. Choice A is incorrect. A worm self-propagates across a network, which matches Program 1 rather than Program 2. Choice B is incorrect. A virus attaches to a host file and needs that file run, which matches Program 3. Choice C is incorrect. Ransomware encrypts and extorts, which matches Program 4.

Question 3. Why is Program 1 considered more dangerous to the whole office than Program 3?

• A) It spreads on its own, so it can reach many machines quickly without anyone acting ✓
• B) It hides inside a trusted game, so the user is tricked into installing it directly
• C) It encrypts files for ransom, so paying the demand becomes the only way to recover the data
• D) It runs only from a macro, so it stays narrowly limited to a single opened document

Explanation: Choice A is correct. Self-propagation lets Program 1 move to many devices with no further user action, which is why the logs already show two more infected laptops; that reach is the danger. Choice B is incorrect. Hiding in a game describes a trojan's delivery, not Program 1. Choice C is incorrect. Encryption for ransom describes Program 4. Choice D is incorrect. Running only from a macro describes Program 3 and actually limits its spread.

Question 4. Which observation is the strongest evidence that Program 1 is a worm rather than a virus?

• A) It displayed a ransom message asking the user to send a payment right away
• B) It was bundled inside a free game that the user downloaded and then ran
• C) It reached two other laptops without any file being opened there ✓
• D) It attached its code to a spreadsheet macro on the first laptop

Explanation: Choice C is correct. Reaching other laptops with no file opened on them shows self-propagation, the trait that separates a worm from a virus, which needs a host file to be run. Choice A is incorrect. A ransom message points to ransomware, not to the worm-versus-virus distinction. Choice B is incorrect. Arriving in a downloaded game points to a trojan. Choice D is incorrect. Attaching to a macro is virus-like behavior, the opposite of what the question asks.

Question 5. What is the best immediate action to limit Program 1's spread across the office?

• A) Pay the ransom demand quickly so the encrypted files can be unlocked again
• B) Disconnect the affected laptops from the network while the threat is removed ✓
• C) Open the spreadsheet macro to study how the infection first started spreading
• D) Email all staff a copy of the suspicious game so they can test it themselves

Explanation: Choice B is correct. Isolating the infected machines from the network cuts off the path a self-spreading worm uses to reach new devices, buying time to clean them. Choice A is incorrect. Paying a ransom addresses encryption, not worm propagation, and is not a containment step. Choice C is incorrect. Opening the macro could trigger more harm and does not contain the spread. Choice D is incorrect. Distributing the malware to staff would widen the infection.