1. Malicious Software Slide Set #5 Textbook Chapter 6 Clicker Questions
                    Peer Instruction Questions for Intro to Computer Security by William E. Johnson, Allison Luzader, Irfan Ahmed is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.

2. None/Other/More than one of the above
Consider and identify the following type of malicious software. This attaches itself to another executable program and is able to do anything that executable program can do. The malware executes secretly when the host program is run.
Virus
Worm
Zombie, bot
None/Other/More than one of the above
Correct Answer = A
Source: Computer Security Principles and Practice, Third Edition, page 205
Question Triggers:
“Use ‘none of the above’”: due to the provided choice
“Identify a set or subset” due to the possibility of multiple choices
“Trolling for misconceptions: There is likely to be significant confusion between worms and viruses
“Analysis and reasoning”—students must tear apart the behavior of the software in order to arrive at the answer
“Qualitative questions” as this requires an understanding of each form of malicious software as well as its features
Total count: 5
Count without none of the above: 4
Count without identify a set: 4
Count without none of the above or identify a set: 3
Complexity: Simple
Presentation: Feature Identification

3. None/Other/More than one of the above
Consider and identify the following type of malicious software. This malware s a copy of itself to other systems or sends itself as an attachment via an instant message service. The malware code is run when the or attachment is received or viewed.
Virus
Worm
Zombie, bot
None/Other/More than one of the above
Correct Answer = B
Source: Computer Security Principles and Practice, Third Edition, page 210
Question Triggers:
“Use ‘none of the above’”: due to the provided choice
“Identify a set or subset” due to the possibility of multiple choices
“Trolling for misconceptions: There is likely to be significant confusion between worms and viruses
“Analysis and reasoning”—students must tear apart the behavior of the software in order to arrive at the answer
“Qualitative questions” as this requires an understanding of each form of malicious software as well as its features
Total count: 5
Count without none of the above: 4
Count without identify a set: 4
Count without none of the above or identify a set: 3
Complexity: Simple
Presentation: Feature Identification

4. None/Other/More than one of the above
Consider and identify the following type of malicious software. This malware secretly takes over another internet-attached computer and then uses that computer to launch or manage attacks that are difficult to trace to the malware’s creator. This type of payload attacks the integrity and availability of the infected system.
Virus
Worm
Zombie, bot
None/Other/More than one of the above
Correct Answer = C
Source: Computer Security Principles and Practice, Third Edition, page
Question Triggers:
“Use ‘none of the above’”: due to the provided choice
“Identify a set or subset” due to the possibility of multiple choices
“Qualitative questions” as this requires an understanding of each form of malicious software as well as its features
Total count: 3
Count without none of the above: 2
Count without identify a set: 2
Count without none of the above or identify a set: 1
Complexity: Simple
Presentation: Feature Identification

5. Which of the following is true for both metamorphic and polymorphic viruses?
Both create a random encryption key to encrypt part of the virus.
Both are rewritten completely with every infection and may change behavior and appearance.
Both mutate with each infection.
Both utilize compression to avoid detection by anti-virus software.
None/Other/More than one of the above
Correct Answer = C
Source: Computer Security Principles and Practice, Third Edition, page 210
Question Triggers:
“Use ‘none of the above’”: due to the provided choice
“Identify a set or subset” due to the possibility of multiple choices
“Compare and contrast” due to the requirement of students knowing the key features of both
“Qualitative questions” as this requires an understanding of both types of viruses as well as their similarities and differences to answer correctly
Total count: 4
Count without none of the above: 3
Count without identify a set: 3
Count without none of the above or identify a set: 2
Complexity: Composite, as it compares two simpler concepts
Presentation: Feature Identification

6. Which of the following is true for only metamorphic viruses?
They create a random encryption key to encrypt part of the virus.
They are rewritten completely with every infection and may change behavior and appearance.
They mutate with each infection.
They utilize compression to avoid detection by anti-virus software.
None/Other/More than one of the above
Correct Answer = B
Source: Computer Security Principles and Practice, Third Edition, page 210
Question Triggers:
“Use ‘none of the above’”: due to the provided choice
“Identify a set or subset” due to the possibility of multiple choices
“Compare and contrast” due to the requirement of students knowing the key differences between both
“Reusing familiar question scenarios” due to the question only slightly pivoting from a truth for both to a truth to one of the choices
“Qualitative questions” as this requires an understanding of both (polymorphic and metamorphic) types of viruses as well as their similarities and differences to answer correctly
Total count: 5
Count without none of the above: 4
Count without identify a set: 4
Count without none of the above or identify a set: 3
Complexity: Composite, as it compares two simpler concepts
Presentation: Feature Identification

7. Which statement below differentiates a virus from a worm?
A virus replicates into an executable. A worm can propagate on its own.
A worm replicates into an executable. A virus can propagate on its own.
A virus bypasses a normal security check. A worm captures keystrokes on a compromised computer.
A worm bypasses a normal security check. A virus captures keystrokes on a compromised computer.
None/Other/More than one of the above
Correct Answer = A
Source: Computer Security Principles and Practice, Third Edition, page 210
Question Triggers:
“Use ‘none of the above’”: due to the provided choice
“Identify a set or subset” due to the possibility of multiple choices
“Compare and contrast” due to the requirement of students knowing the key differences between both
“Qualitative questions” as this requires an understanding of the relationship between viruses and worms
Total count: 4
Count without none of the above: 3
Count without identify a set: 3
Count without none of the above or identify a set: 2
Complexity: Composite, as it compares two simpler concepts
Presentation: Feature Identification

8. Which statement below differentiates a botnet and a worm?
A worm propagates itself and activates itself.
A worm is initially controlled by some central facility.
A wormnet can act in a coordinated manner.
A botnet has a remote control facility.
None/Other/More than one of the above
Correct Answer = E (both A and D are correct)
Source: Computer Security Principles and Practice, Third Edition, page 210
Question Triggers:
“Use ‘none of the above’”: due to the provided choice
“Identify a set or subset” due to the possibility of multiple choices
“Compare and contrast” due to the requirement of students knowing the key differences between both
“Qualitative questions” as this requires an understanding of the relationship between botnets and worms
Total count: 4
Count without none of the above: 3
Count without identify a set: 3
Count without none of the above or identify a set: 2
Complexity: Composite, as it compares two simpler concepts
Presentation: Feature Identification

9. Direct kernel object manipulation (DKOM) …
is able to delete process from kernel space.
removes privileges for a process so it no longer runs as root.
deletes the process header for a process, essentially rendering it useless.
removes the pointer to a process from the doubly-linked list so it appears as removed (hidden).
None/Other/More than one of the above
Correct Answer = D
Source: Computer Security Principles and Practice, Third Edition, page 210
Question Triggers:
“Use ‘none of the above’”: due to the provided choice
“Identify a set or subset” due to the possibility of multiple choices
Total count: 2
Count without none of the above: 1
Count without identify a set: 1
Count without none of the above or identify a set: 0
Complexity: Simple (in its context within this course)
Presentation: Definitional

10. None/Other/More than one of the above
Threat mitigation is an important aspect of malware countermeasure. This word describes the act of determining that an attack has occurred and locating the malware.
Identification
Detection
Removal
None/Other/More than one of the above
Correct Answer = B
Source: Computer Security Principles and Practice, Third Edition, page 210
Question Triggers:
“Use ‘none of the above’”: due to the provided choice
“Identify a set or subset” due to the possibility of multiple choices
“Qualitative questions” as this requires understanding the similarities and differences of each option in order to successfully answer the question
Total count: 3
Count without none of the above: 2
Count without identify a set: 2
Count without none of the above or identify a set: 1
Complexity: Simple
Presentation: Definitional