nerdexam
GIAC

GSLC · Question #17

Which of the following is a virus that can redirect the disk head to read another sector instead of the one in which it resides?

The correct answer is C. Stealth virus. A stealth virus actively hides itself by intercepting disk read requests and redirecting the disk head to a clean sector, making detection difficult.

Security Architecture & Engineering

Question

Which of the following is a virus that can redirect the disk head to read another sector instead of the one in which it resides?

Options

  • AMultipartite virus
  • BMacro virus
  • CStealth virus
  • DBoot sector virus

How the community answered

(38 responses)
  • A
    8% (3)
  • B
    3% (1)
  • C
    87% (33)
  • D
    3% (1)

Why each option

A stealth virus actively hides itself by intercepting disk read requests and redirecting the disk head to a clean sector, making detection difficult.

AMultipartite virus

A multipartite virus infects both the boot sector and executable files simultaneously, but does not redirect disk head reads to hide itself.

BMacro virus

A macro virus embeds malicious macros in document files such as Word or Excel and executes when the document is opened, not via disk sector redirection.

CStealth virusCorrect

A stealth virus uses interception techniques to redirect disk head reads away from the infected sector, returning the contents of a clean sector instead. This allows the virus to remain resident in memory and actively conceal its presence from antivirus tools and the OS. The redirection mechanism is the defining characteristic that distinguishes stealth viruses from other types.

DBoot sector virus

A boot sector virus infects the master boot record or volume boot record and loads before the OS, but does not use disk head redirection as a concealment method.

Concept tested: Stealth virus disk sector redirection technique

Source: https://www.comptia.org/content/guides/what-is-a-computer-virus

Topics

#stealth virus#malware types#disk manipulation#virus evasion

Community Discussion

No community discussion yet for this question.

Full GSLC Practice