Test: Internet & Viruses- 2 - Class 9 MCQ

Explanation:
In computer security, integrity means that computer system assets can be modified only by authorized parties. Here is a detailed explanation of the concept:
Integrity:
Integrity refers to the assurance that data or information remains intact and unaltered during storage, transmission, or processing. It ensures that the data is not tampered with or modified without authorization. The integrity of computer system assets is crucial in maintaining the reliability and trustworthiness of the system.
Key Points:
- Integrity ensures that computer system assets are modified only by authorized parties.
- Unauthorized modification can lead to data corruption, loss of trust, and compromised system functionality.
- Implementing integrity measures involves various techniques such as access controls, encryption, digital signatures, and checksums.
- Access controls restrict access to sensitive assets, ensuring that only authorized users can modify them.
- Encryption protects data from unauthorized modifications during transmission or storage by encrypting it with a secret key.
- Digital signatures provide a mechanism to verify the authenticity and integrity of a document or message.
- Checksums are used to detect changes in data by generating a unique value based on the data and comparing it with the received value.
Conclusion:
Integrity is a fundamental principle in computer security that ensures the trustworthiness and reliability of computer system assets. By allowing modifications only by authorized parties, it helps protect against unauthorized access, data corruption, and loss of integrity.

Answer:
The correct answer is A: Trap door.
A trap door is a code that recognizes some special sequence of input or is triggered by being run from a certain user ID or by an unlikely sequence of events. It is often used in computer security as a hidden entry point to bypass normal authentication or access control mechanisms.
Here is a detailed explanation of the given options and why the correct answer is trap door:
Trojan horse:
- A Trojan horse is a malicious program that disguises itself as a legitimate software to trick users into downloading and running it.
- It is not directly related to recognizing special sequences of input or being triggered by specific events.
- Unlike a trap door, a Trojan horse is designed to perform malicious activities without the user's knowledge or consent.
Logic Bomb:
- A logic bomb is a piece of code that is intentionally inserted into a program to execute a malicious action when certain conditions are met.
- While it shares some similarities with a trap door, a logic bomb is typically used to cause harm or damage at a specific time or under specific circumstances.
- It is not primarily focused on recognizing input sequences or being triggered by certain events.
Virus:
- A virus is a type of malware that can replicate itself by infecting other programs or files.
- While viruses can be triggered by certain events or conditions, they do not specifically recognize special input sequences.
- The primary goal of a virus is to spread and cause damage to the infected system, rather than provide hidden access or bypass authentication.
Trap Door:
- A trap door is a hidden entry point or code that allows unauthorized access to a system or bypasses security measures.
- It can recognize specific input sequences or be triggered by certain events, such as running from a specific user ID.
- Trap doors are often intentionally created for legitimate purposes, such as debugging or system maintenance, but can also be exploited by attackers for unauthorized access.
In conclusion, out of the given options, the correct answer that matches the description of recognizing special input sequences or being triggered by specific events is trap door (option A).

Which of the following malicious program do not replicate automatically?

Answer: Trojan Horse

Explanation:

A malicious program is a type of software that is designed to cause harm to a computer system or network. These programs can replicate themselves and spread to other systems, or they can be manually installed by a user.

Different types of malicious programs:

• Trojan Horse: A Trojan Horse is a type of malicious program that disguises itself as a legitimate file or software. It does not replicate automatically and requires user interaction to be installed.


• Virus: A virus is a malicious program that can replicate itself and spread to other files or systems. It requires a host file or program to attach itself to and can spread through various means such as email attachments or infected downloads.


• Worm: A worm is a self-replicating malicious program that can spread across a network without user interaction. It can exploit vulnerabilities in a system to gain access and replicate itself to other connected systems.


• Zombie: A zombie is not a type of malicious program. It refers to a compromised computer or device that is under the control of a remote attacker. Zombies are typically used in botnets to carry out malicious activities.

Based on the above information, the correct answer is:

Trojan Horse

A Trojan Horse is a malicious program that does not replicate automatically and requires user interaction to be installed.

Explanation:
A worm is a type of malicious software that can replicate itself and spread to other systems. It does not require any user interaction to spread, unlike viruses.
i. A worm mails a copy of itself to other systems.
- This statement is true. Worms can use email or other communication methods to send copies of themselves to other systems.
ii. A worm executes a copy of itself on another system.
- This statement is also true. Once a worm has successfully spread to another system, it can execute a copy of itself on that system to continue its replication process.
Therefore, the correct answer is C: True, True. Both statements accurately describe the behavior of a worm.

Denial of Service Attacks and Zombies

A denial of service (DoS) attack is a malicious attempt to disrupt the normal functioning of a network, computer system, or website by overwhelming it with a flood of internet traffic. This can result in the targeted website becoming slow or completely inaccessible to legitimate users. In DoS attacks, zombies, also known as botnets, are often used as the primary method to carry out the attack.

What are Zombies?

Zombies are computers or devices that have been compromised by a hacker or malware and are under the control of the attacker. These compromised devices are typically part of a botnet, which is a network of infected computers that can be remotely controlled by the attacker. The attacker uses the botnet to send a massive amount of traffic or requests to the targeted website, overwhelming its capacity to handle legitimate user requests.

Key Points:
- Zombies are computers or devices that have been compromised and are under the control of an attacker.
- They are part of a botnet, which is a network of infected computers.
- The attacker uses the botnet to carry out a DoS attack.
- The botnet floods the targeted website with a massive amount of traffic or requests.
- This overwhelms the website's capacity and makes it slow or inaccessible to legitimate users.
Conclusion

In denial of service attacks, zombies are used as a means to carry out the attack. They allow the attacker to generate a large volume of traffic or requests, which overwhelms the targeted website and disrupts its normal functioning. It is important for organizations to have robust security measures in place to detect and mitigate such attacks, as well as to regularly update and patch their systems to prevent them from being compromised and turned into zombies.

Parasitic Virus
A parasitic virus is a type of computer virus that attaches itself to executable files and replicates when the infected program is executed. Here is a detailed explanation of a parasitic virus:
- Definition: A parasitic virus is a type of malware that infects executable files, such as .exe or .com files, by attaching itself to the host program. It becomes a part of the infected program and spreads when the program is executed.
- Attachment and Replication: When a parasitic virus infects an executable file, it modifies the file's code to include its own code. This allows the virus to execute its malicious activities whenever the infected program is run. The virus also searches for other executable files on the system and attempts to infect them as well, spreading its infection to other programs.
- Hidden Behavior: Parasitic viruses often exhibit stealthy behavior to avoid detection. They may hide their presence within the infected file by using various techniques such as encryption, obfuscation, or polymorphism. This makes it challenging for antivirus software to detect and remove them.
- Impact: Once a parasitic virus infects an executable file, it can cause various harmful effects. It may modify or corrupt the original program's functionality, steal sensitive information, or create a backdoor for unauthorized access. The virus can also spread to other systems through infected files, causing a widespread infection.
- Prevention and Removal: To protect against parasitic viruses, it is important to use updated antivirus software and regularly scan executable files for any signs of infection. Additionally, practicing safe browsing habits and avoiding downloading files from untrusted sources can help prevent infection. If a parasitic virus is detected, it is recommended to quarantine or remove the infected files using antivirus software.
Overall, a parasitic virus is a type of malware that attaches itself to executable files and replicates when the infected program is executed. It can cause significant damage to systems and compromise sensitive information, making it important to take necessary precautions to prevent and remove such infections.

Polymorphic Virus
- A polymorphic virus is a type of malware that creates copies during replication that are functionally equivalent but have distinctly different bit patterns.
- These viruses are designed to evade detection by antivirus software, as each copy has a unique signature.
- Polymorphic viruses achieve this by using encryption, mutation, and other techniques to constantly change their appearance.
- Encryption involves encoding the virus code using a cryptographic algorithm, making it difficult for antivirus programs to recognize the malicious code.
- Mutation involves making slight modifications to the virus code, such as adding or removing junk instructions, changing variable names, or reordering code segments.
- By constantly changing their appearance, polymorphic viruses can bypass signature-based detection methods that rely on recognizing specific patterns or signatures.
- Polymorphic viruses typically infect executable files, such as .exe or .dll files, and can spread through various means, such as email attachments, infected websites, or file-sharing networks.
- To protect against polymorphic viruses, it is important to keep antivirus software up to date, avoid downloading files from untrusted sources, and exercise caution when opening email attachments or clicking on suspicious links.

Propagation Phase in Virus:
The propagation phase is a crucial step in the life cycle of a computer virus. During this phase, the virus spreads and replicates itself by infecting other programs or specific areas on the disk. Here is a detailed explanation of the propagation phase in a virus:
1. Definition: The propagation phase is the stage where the virus actively seeks out new hosts and infects them by inserting its identical copy into various programs or system areas.
2. Methods of Propagation: Viruses use different methods to propagate and infect other programs. Some common methods include:
- File Infection: The virus attaches itself to executable files and infects them. When these infected files are executed, the virus spreads to other programs on the system.
- Boot Sector Infection: The virus infects the boot sector of the computer's hard drive or other storage devices. When the system is booted from an infected disk, the virus gets loaded into memory and can infect other programs.
- Network Propagation: Viruses can spread through networks by exploiting vulnerabilities in network protocols or by infecting shared files and folders.
3. Replication: Once the virus has infected a program or system area, it creates an identical copy of itself and inserts it into other programs or areas. This ensures that the virus can continue to spread and infect more systems.
4. Self-Propagation: Some viruses are designed to automatically propagate themselves without any user intervention. They can scan the system or network for vulnerable programs and initiate the infection process.
5. Stealth Techniques: During the propagation phase, viruses often employ stealth techniques to avoid detection. They may modify their code or manipulate system functions to hide their presence and make it difficult for antivirus software to detect them.
6. Continued Spreading: The propagation phase is not limited to a single cycle. Once a virus infects a new host, it can continue to propagate and infect other programs or areas, creating a chain reaction of infections.
In conclusion, the propagation phase in a virus is the stage where it spreads and replicates itself by infecting other programs or specific areas on the disk. This phase is critical for the virus to ensure its survival and widespread dissemination.

The Internet poses specific security problems because:

• It was designed to be easily accessible: The Internet was initially designed to be open and accessible, which makes it vulnerable to security threats. The ease of access allows malicious actors to exploit vulnerabilities and gain unauthorized access to sensitive information.


• Everyone uses it: The widespread use of the Internet increases the potential for security breaches. With billions of users worldwide, it becomes challenging to ensure the security of each individual's online activities. This makes it an attractive target for cybercriminals.


• Viruses cannot be controlled: While it is true that viruses and malware can be detected and controlled to some extent, it is virtually impossible to eliminate them completely. The constantly evolving nature of viruses and the wide range of attack vectors make it difficult to stay ahead of the threats.


• It changes so fast: The Internet is a dynamic environment that constantly evolves with new technologies, protocols, and applications. This rapid pace of change introduces new vulnerabilities and challenges for security professionals to keep up with, making it difficult to establish robust security measures.

In conclusion, the Internet poses specific security problems due to its easy accessibility, widespread usage, the inability to completely control viruses, and the rapid pace of change. To mitigate these risks, it is crucial for individuals and organizations to employ robust security measures, such as firewalls, antivirus software, and regular updates, to protect their online activities and sensitive information.

Classification of Sasser, Netsky, and Sobig:
1. Introduction:
Sasser, Netsky, and Sobig are all well-known computer viruses that caused significant damage when they were active. Understanding their classification can help in implementing appropriate security measures.
2. Sasser:
Sasser is a computer worm that spread through network vulnerabilities in Microsoft Windows operating systems. It exploited a flaw in the Windows LSASS (Local Security Authority Subsystem Service) to propagate itself. Sasser did not fall under the category of Trojan horses or virus hoaxes.
3. Netsky:
Netsky is another computer worm that primarily spread through email attachments. It used social engineering techniques to trick users into opening infected files. Netsky did not fall under the category of DoS (Denial of Service) viruses or Trojan horses.
4. Sobig:
Sobig was a family of computer worms that spread via email attachments. It targeted Windows systems and relied on social engineering to deceive users. Sobig did not fall under the category of DoS viruses, virus hoaxes, or Trojan horses.
5. Conclusion:
Based on the information provided, the correct classification for Sasser, Netsky, and Sobig is worm viruses (B). These viruses spread independently and had self-propagation capabilities, which distinguish them from other types of malware. Understanding the classification of viruses is essential for effective cybersecurity measures.

The software that sits on the Internet analyzing Web traffic is referred to as a:
There are several options given, and the correct answer is "D: Sniffer."
Explanation:
Here is a detailed explanation of each option and why "Sniffer" is the correct answer:
1. Worm:
- A worm is a type of malicious software that replicates itself and spreads across computer networks.
- It does not specifically analyze web traffic, so it is not the correct answer.
2. Cracker:
- A cracker refers to an individual who breaks into computer systems or networks with malicious intent.
- While crackers may use software tools to analyze web traffic, the term "cracker" does not specifically refer to the software itself.
3. Cookie:
- A cookie is a small piece of data stored on a user's computer by a website to remember information about the user.
- Cookies are not software that analyzes web traffic, so it is not the correct answer.
4. Sniffer:
- A sniffer, also known as a network analyzer or packet analyzer, is software that captures and analyzes network traffic.
- It can intercept and analyze data packets flowing over a network, including web traffic.
- Sniffers are commonly used by network administrators, security professionals, and hackers to monitor and analyze network activity.
- Therefore, "Sniffer" is the correct answer to the given question.
In conclusion, the software that sits on the Internet analyzing web traffic is referred to as a "Sniffer."

Social engineering is the correct answer. Here is a detailed explanation:
Definition:
Social engineering is a form of cyber attack where attackers manipulate and deceive individuals to gain unauthorized access to information, systems, or networks. It involves exploiting human psychology and trust to trick people into revealing sensitive information, such as passwords or personal details.
Explanation:
Social engineering attacks often involve impersonating legitimate users or members of a company to gain the trust of their targets. The attackers may use various techniques, such as:
1. Phishing: Sending deceptive emails or messages that appear to be from a reputable source, such as a bank or a company's IT department, requesting the recipient to provide their login credentials.
2. Pretexting: Creating a fictional scenario or pretext to trick individuals into divulging sensitive information. For example, an attacker might pose as a customer support representative and convince the target to provide their password for verification purposes.
3. Baiting: Offering something enticing, such as a free gift or download, in exchange for personal information or login credentials.
4. Impersonation: Pretending to be a trusted individual, colleague, or superior in order to gain access to sensitive information. This can happen through phone calls, emails, or even in person.
Prevention:
To protect yourself from social engineering attacks, it is important to:
- Be cautious of unsolicited requests for sensitive information.
- Verify the legitimacy of requests by contacting the company or individual through trusted channels.
- Never share passwords or personal information through email or other unsecured means.
- Stay updated on the latest security practices and educate yourself about social engineering techniques.
- Use strong, unique passwords and enable two-factor authentication whenever possible.
By being aware of these tactics and practicing good security hygiene, you can reduce the risk of falling victim to social engineering attacks.

Fault-tolerant systems

• Fault-tolerant systems are computer systems that use duplication of components and data to cope with system failures.


• They are designed to continue functioning even if certain components or data become unavailable or fail.


• These systems typically have redundant components and data stored in multiple locations.


• If one component or data source fails, the system can switch to a backup or duplicate component or data source to maintain operations.


• This redundancy helps ensure that the system remains operational and minimizes downtime or loss of data.


• Fault-tolerant systems are commonly used in critical applications where system failure could have severe consequences, such as in aerospace, healthcare, or financial industries.

Restoring Computing and Communication Services after a Disruption

The appropriate plan for restoring computing and communication services after a disruption such as an earthquake is a Disaster Recovery Plan.

A Disaster Recovery Plan is a detailed strategy that outlines the steps and procedures to be followed in order to restore and recover IT infrastructure and services after a disaster or disruptive event. It focuses on minimizing downtime and ensuring the continuity of critical systems and data.

Key components of a Disaster Recovery Plan include:

• Assessment of potential risks and vulnerabilities


• Identification of critical systems and data


• Establishment of recovery objectives and priorities


• Implementation of backup and recovery mechanisms


• Testing and validation of the plan


• Training and awareness programs for staff


• Documentation and maintenance of the plan

By having a well-defined Disaster Recovery Plan in place, organizations can effectively respond to disruptions and ensure the timely restoration of computing and communication services.

Firewalls are described as:
A: The transmission of data through telecommunication lines in "scrambled" form.
B: A "gatekeeper" system that protects a company's intranets and other computer networks from intrusion.
C: The act of ensuring the accuracy, integrity, and safety of all business processes and resources.
D: Audit system to identify the controls that govern individual information systems and access their efficiency.
Answer: B
Explanation:
Firewalls are a critical component of network security and are designed to protect computer networks from unauthorized access and malicious activities. Here is a detailed explanation of why option B is the correct description of firewalls:
1. Gatekeeper system: Firewalls act as a gatekeeper, controlling the incoming and outgoing network traffic based on predetermined security rules. They monitor and filter the data packets passing through the network, allowing only authorized traffic and blocking potential threats.
2. Protection from intrusion: Firewalls protect a company's intranets and other computer networks from unauthorized access and intrusion attempts. They prevent external threats, such as hackers, malware, and viruses, from compromising the network and accessing sensitive information.
3. Network security: Firewalls play a crucial role in maintaining network security by enforcing security policies and monitoring network traffic. They can identify and block suspicious activities, such as unauthorized access attempts or unusual data patterns, ensuring the network's integrity and safety.
4. Filtering and blocking: Firewalls can be configured to filter and block specific types of network traffic based on predefined rules. This includes blocking certain IP addresses, restricting access to specific ports or protocols, and preventing malicious content from entering the network.
5. Intrusion detection and prevention: Firewalls often include intrusion detection and prevention systems (IDPS) that monitor network traffic for signs of potential threats. They can detect and respond to suspicious activities in real-time, providing an additional layer of security against attacks.
In conclusion, firewalls are gatekeeper systems that protect a company's intranets and computer networks from intrusion by monitoring and filtering network traffic. They play a crucial role in network security, ensuring the integrity and safety of the network and its resources.