nerdexam
EC-Council

312-50V10 · Question #707

Which of the following describes the characteristics of a Boot Sector Virus?

The correct answer is C. Moves the MBR to another location on the hard disk and copies itself to the original location of the. A Boot Sector Virus relocates the original Master Boot Record (MBR) to another area on the hard disk, then installs itself in the MBR's original location to execute on every boot.

Malware Threats

Question

Which of the following describes the characteristics of a Boot Sector Virus?

Options

  • AModifies directory table entries so that directory entries point to the virus code instead of the
  • BMoves the MBR to another location on the RAM and copies itself to the original location of the
  • CMoves the MBR to another location on the hard disk and copies itself to the original location of the
  • DOverwrites the original MBR and only executes the new virus code.

How the community answered

(28 responses)
  • A
    7% (2)
  • C
    89% (25)
  • D
    4% (1)

Why each option

A Boot Sector Virus relocates the original Master Boot Record (MBR) to another area on the hard disk, then installs itself in the MBR's original location to execute on every boot.

AModifies directory table entries so that directory entries point to the virus code instead of the

Modifying directory table entries to redirect execution describes a Directory/File Allocation Table virus, not a boot sector virus.

BMoves the MBR to another location on the RAM and copies itself to the original location of the

Moving the MBR to RAM is incorrect because RAM is volatile and does not persist between reboots; the MBR must be relocated on persistent disk storage.

CMoves the MBR to another location on the hard disk and copies itself to the original location of theCorrect

Boot sector viruses work by moving the legitimate MBR to a different sector on the hard disk so the original boot instructions are preserved but hidden. The virus copies itself into the original MBR location, ensuring it is loaded into memory by the BIOS before the OS starts. This allows the virus to execute every time the system boots while optionally chaining to the real MBR to load the OS normally.

DOverwrites the original MBR and only executes the new virus code.

Overwriting the MBR and only running virus code would destroy the ability to boot the OS, which would immediately reveal the infection and is not how boot sector viruses are designed to operate.

Concept tested: Boot sector virus MBR infection mechanism

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/intelligence/boot-sector-malware

Topics

#boot sector virus#MBR#virus types#malware classification

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V10 Practice