nerdexam
EC-Council

312-50V11 · Question #707

Which of the following describes the characteristics of a Boot Sector Virus?

The correct answer is C. Moves the MBR to another location on the hard disk and copies itself to the original location of the. A boot sector virus preserves the original MBR by relocating it to another disk sector, then installs itself at the original MBR location to execute before the OS loads.

Malware Threats

Question

Which of the following describes the characteristics of a Boot Sector Virus?

Options

  • AModifies directory table entries so that directory entries point to the virus code instead of the
  • BMoves the MBR to another location on the RAM and copies itself to the original location of the
  • CMoves the MBR to another location on the hard disk and copies itself to the original location of the
  • DOverwrites the original MBR and only executes the new virus code.

How the community answered

(48 responses)
  • A
    2% (1)
  • C
    94% (45)
  • D
    4% (2)

Why each option

A boot sector virus preserves the original MBR by relocating it to another disk sector, then installs itself at the original MBR location to execute before the OS loads.

AModifies directory table entries so that directory entries point to the virus code instead of the

Modifying directory table entries to redirect execution describes a directory or file allocation table (FAT) virus, not a boot sector virus.

BMoves the MBR to another location on the RAM and copies itself to the original location of the

The MBR is moved to another location on the hard disk, not to RAM - RAM is volatile and does not persist across reboots, making it unsuitable for virus storage.

CMoves the MBR to another location on the hard disk and copies itself to the original location of theCorrect

A boot sector virus relocates the legitimate Master Boot Record to another location on the hard disk and writes its own code to the original MBR location. This ensures the virus executes first at boot time before control is passed to the relocated original MBR, allowing the OS to load normally while the virus remains resident and hidden.

DOverwrites the original MBR and only executes the new virus code.

Simply overwriting the MBR without preserving it would corrupt the boot process and prevent the OS from loading, which is characteristic of a wiper/destructive payload, not a typical boot sector virus designed for persistence.

Concept tested: Boot sector virus MBR infection mechanism

Source: https://www.cisa.gov/sites/default/files/publications/Ransomware_Guide_0.pdf

Topics

#boot sector virus#MBR#virus characteristics#malware types

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice