nerdexam
EC-Council

312-50V10 · Question #500

Which of the following BEST describes the mechanism of a Boot Sector Virus?

The correct answer is A. Moves the MBR to another location on the hard disk and copies itself to the original location of the. A boot sector virus infects the Master Boot Record (MBR) by relocating it and inserting itself in its place, allowing the virus to execute before the OS loads while keeping the system bootable. This distinguishes it from viruses that simply overwrite or redirect directory entries

Malware Threats

Question

Which of the following BEST describes the mechanism of a Boot Sector Virus?

Options

  • AMoves the MBR to another location on the hard disk and copies itself to the original location of the
  • BMoves the MBR to another location on the RAM and copies itself to the original location of the
  • COverwrites the original MBR and only executes the new virus code
  • DModifies directory table entries so that directory entries point to the virus code instead of the

How the community answered

(35 responses)
  • A
    91% (32)
  • B
    6% (2)
  • D
    3% (1)

Why each option

A boot sector virus infects the Master Boot Record (MBR) by relocating it and inserting itself in its place, allowing the virus to execute before the OS loads while keeping the system bootable. This distinguishes it from viruses that simply overwrite or redirect directory entries.

AMoves the MBR to another location on the hard disk and copies itself to the original location of theCorrect

By moving the original MBR to another disk location rather than destroying it, the boot sector virus ensures the system still boots normally after the virus code executes - maintaining stealth and persistence. The virus copies itself to the original MBR location so it is the first code executed by the BIOS during the boot process, before any operating system or antivirus can load. This technique allows the virus to load into memory on every boot and potentially infect other disks.

BMoves the MBR to another location on the RAM and copies itself to the original location of the

RAM is volatile and loses all data when power is removed, so moving the MBR to RAM would not result in a persistent infection that survives reboots.

COverwrites the original MBR and only executes the new virus code

Simply overwriting the MBR with only virus code would typically render the system unbootable, which would quickly expose the infection rather than allowing it to persist silently.

DModifies directory table entries so that directory entries point to the virus code instead of the

Modifying directory table entries to point to virus code describes a directory or file infector virus technique, not a boot sector virus - which operates below the filesystem level.

Concept tested: Boot sector virus MBR infection and persistence mechanism

Source: https://www.cisa.gov/sites/default/files/publications/Understanding-Malware_S508C.pdf

Topics

#boot sector virus#MBR#malware mechanism#virus types

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V10 Practice