nerdexam
EC-Council

312-50V12 · Question #239

An IT security team is conducting an internal review of security protocols in their organization to identify potential vulnerabilities. During their investigation, they encounter a suspicious…

The correct answer is B. The program is a keylogger; the team should employ intrusion detection systems and regularly. The program described, which logs all user keystrokes, is definitively identified as a keylogger. To prevent similar attacks in the future, the security team should implement intrusion detection systems to monitor for malicious activity.

Submitted by obi.ng· Mar 4, 2026System Hacking Phases and Attack Techniques

Question

An IT security team is conducting an internal review of security protocols in their organization to identify potential vulnerabilities. During their investigation, they encounter a suspicious program running on several computers. Further examination reveals that the program has been logging all user keystrokes. How can the security team confirm the type of program and what countermeasures should be taken to ensure the same attack does not occur in the future?

Options

  • AThe program is spyware; the team should use password managers and encrypt sensitive data.
  • BThe program is a keylogger; the team should employ intrusion detection systems and regularly
  • CThe program is a keylogger; the team should educate employees about phishing attacks and
  • DThe program is a Trojan; the team should regularly update antivirus software and install a reliable

How the community answered

(28 responses)
  • A
    4% (1)
  • B
    82% (23)
  • C
    11% (3)
  • D
    4% (1)

Why each option

The program described, which logs all user keystrokes, is definitively identified as a keylogger. To prevent similar attacks in the future, the security team should implement intrusion detection systems to monitor for malicious activity.

AThe program is spyware; the team should use password managers and encrypt sensitive data.

While a keylogger is a type of spyware, 'keylogger' is the more specific and accurate classification given the explicit keystroke logging behavior; password managers and data encryption do not prevent the logging of keystrokes as they are typed, nor do they detect the keylogger itself.

BThe program is a keylogger; the team should employ intrusion detection systems and regularlyCorrect

The program's described behavior of "logging all user keystrokes" precisely defines a keylogger. Intrusion Detection Systems (IDS) are designed to monitor network and/or host activities for suspicious patterns or known attack signatures, providing a crucial technical control to detect the presence or activity of keyloggers and other malicious software.

CThe program is a keylogger; the team should educate employees about phishing attacks and

While keylogger is the correct program type, educating employees about phishing primarily helps prevent initial infection vectors rather than providing a direct technical mechanism to detect an active keylogger on a system.

DThe program is a Trojan; the team should regularly update antivirus software and install a reliable

A keylogger can be delivered by a Trojan, but 'keylogger' describes the specific functionality observed; while antivirus updates are essential, an Intrusion Detection System (IDS) offers more comprehensive monitoring for anomalous activities indicative of various intrusions, including keyloggers.

Concept tested: Malware identification and intrusion detection systems

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/threats/keyloggers

Topics

#Keylogger#Malware#Intrusion Detection#Security Audits

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice