nerdexam
EC-Council

312-50V9 · Question #368

Which of the following BEST describes the mechanism of a Boot Sector Virus?

The correct answer is A. Moves the MBR to another location on the hard disk and copies itself to the original location of the. A boot sector virus preserves the original MBR by relocating it and then installs itself in the MBR's original location so it executes before the OS on every boot.

Malware Threats

Question

Which of the following BEST describes the mechanism of a Boot Sector Virus?

Options

  • AMoves the MBR to another location on the hard disk and copies itself to the original location of the
  • BMoves the MBR to another location on the RAM and copies itself to the original location of the
  • COverwrites the original MBR and only executes the new virus code
  • DModifies directory table entries so that directory entries point to the virus code instead of the

How the community answered

(28 responses)
  • A
    89% (25)
  • B
    7% (2)
  • C
    4% (1)

Why each option

A boot sector virus preserves the original MBR by relocating it and then installs itself in the MBR's original location so it executes before the OS on every boot.

AMoves the MBR to another location on the hard disk and copies itself to the original location of theCorrect

By moving the original MBR to another sector on the disk and writing its own code to the original MBR location, the virus ensures it is loaded first by the BIOS at boot time. This technique also preserves the original boot logic so the system can still start normally, helping the virus avoid detection while remaining persistent across reboots.

BMoves the MBR to another location on the RAM and copies itself to the original location of the

The MBR is stored on disk, not in RAM - moving it to RAM would not create persistence across reboots and is not how boot sector viruses operate.

COverwrites the original MBR and only executes the new virus code

Simply overwriting the MBR without preserving the original boot code would typically prevent the system from booting, making the infection immediately obvious and defeating the virus's purpose of stealth persistence.

DModifies directory table entries so that directory entries point to the virus code instead of the

Modifying directory table entries to redirect execution is characteristic of a directory virus or file infector, not a boot sector virus.

Concept tested: Boot sector virus MBR infection mechanism

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-83r1.pdf

Topics

#boot sector virus#MBR#malware mechanisms#virus types

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V9 Practice