nerdexam
EC-Council

312-50V11 · Question #500

Which of the following BEST describes the mechanism of a Boot Sector Virus?

The correct answer is A. Moves the MBR to another location on the hard disk and copies itself to the original location of the. A boot sector virus relocates the original MBR to another disk sector and writes itself to the original MBR location, executing before the OS while preserving normal boot functionality.

Malware Threats

Question

Which of the following BEST describes the mechanism of a Boot Sector Virus?

Options

  • AMoves the MBR to another location on the hard disk and copies itself to the original location of the
  • BMoves the MBR to another location on the RAM and copies itself to the original location of the
  • COverwrites the original MBR and only executes the new virus code
  • DModifies directory table entries so that directory entries point to the virus code instead of the

How the community answered

(45 responses)
  • A
    93% (42)
  • B
    2% (1)
  • D
    4% (2)

Why each option

A boot sector virus relocates the original MBR to another disk sector and writes itself to the original MBR location, executing before the OS while preserving normal boot functionality.

AMoves the MBR to another location on the hard disk and copies itself to the original location of theCorrect

A boot sector virus moves the legitimate MBR to a different sector on the hard disk, then copies its own code to the original MBR location. When the system powers on, the BIOS loads the virus code from the MBR first; the virus then loads the real MBR from its relocated position to allow the OS to boot normally. This preserves stealth by keeping the system functional while ensuring the virus executes on every boot.

BMoves the MBR to another location on the RAM and copies itself to the original location of the

RAM is volatile and loses all data on power loss, so the MBR cannot be relocated there - it must persist on the disk to survive reboots.

COverwrites the original MBR and only executes the new virus code

Overwriting the MBR without preserving the original boot code would typically corrupt the boot process and render the disk unbootable, not typical of functional malware.

DModifies directory table entries so that directory entries point to the virus code instead of the

Modifying directory table entries to redirect to virus code describes a file system or directory virus infection technique, not a boot sector virus.

Concept tested: Boot sector virus MBR relocation and infection

Source: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/understanding-malware

Topics

#boot sector virus#MBR#malware mechanism#virus types

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice