nerdexam
EC-Council

312-50V12 · Question #4

Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon reviewing, he finds that user data have been exfiltrated by an attacker. AV tools a

The correct answer is A. File-less malware. In this scenario, the attacker used file-less malware to bypass the company's application whitelisting. File-less malware resides entirely in memory, making it difficult for antivirus software and IDS/IPS to detect. It can run in the context of a trusted process or system applica

Submitted by mike_84· Mar 4, 2026Fundamentals

Question

Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon reviewing, he finds that user data have been exfiltrated by an attacker. AV tools are unable to find any malicious software, and the IDS/IPS has not reported on any non- whitelisted programs. What type of malware did the attacker use to bypass the company's application whitelisting?

Options

  • AFile-less malware
  • BZero-day malware
  • CPhishing malware
  • DLogic bomb malware

How the community answered

(29 responses)
  • A
    93% (27)
  • B
    3% (1)
  • C
    3% (1)

Explanation

In this scenario, the attacker used file-less malware to bypass the company's application whitelisting. File-less malware resides entirely in memory, making it difficult for antivirus software and IDS/IPS to detect. It can run in the context of a trusted process or system application, and can be delivered through various attack vectors, including phishing emails, malicious websites, or network exploits.

Topics

#File-less malware#Malware detection evasion#Application whitelisting bypass

Community Discussion

No community discussion yet for this question.

Full 312-50V12 Practice