Memory-resident malware detection is challenging because:

Question

Options

• AIt does not modify disk-based files
• BIt only activates during a full moon
• CIt requires physical access to the server
• DIt can be easily detected with traditional antivirus

• A
  91% (21)
• C
  4% (1)
• D
  4% (1)

Explanation

Memory-resident malware (also called fileless malware) operates entirely within RAM, injecting malicious code into legitimate running processes like PowerShell or explorer.exe - leaving no trace on disk. Traditional antivirus tools are designed to scan files on disk, so they cannot detect threats that never write to the filesystem, making option A correct.

Why the distractors are wrong:

• B is absurd - malware activation is triggered by code logic, not lunar cycles.
• C is incorrect - memory-resident malware is typically deployed remotely via exploits or phishing, requiring no physical access.
• D is the opposite of true - traditional AV cannot easily detect it, which is precisely what makes it dangerous.

Memory tip: Think "no file, no find" - if malware lives only in RAM and never touches the disk, a file-scanning antivirus is essentially looking in the wrong place entirely.

No community discussion yet for this question.