nerdexam
GIAC

GSLC · Question #334

Which of the following viruses replaces the boot sector data with its own malicious code?

The correct answer is C. MBR. An MBR (Master Boot Record) virus overwrites the boot sector with its own malicious code, executing before the operating system loads.

Security Operations & Incident Response Leadership

Question

Which of the following viruses replaces the boot sector data with its own malicious code?

Options

  • AChernobyl
  • BExplore.Zip
  • CMBR
  • DNimda

How the community answered

(22 responses)
  • C
    95% (21)
  • D
    5% (1)

Why each option

An MBR (Master Boot Record) virus overwrites the boot sector with its own malicious code, executing before the operating system loads.

AChernobyl

Chernobyl (CIH) is a file-infecting virus that overwrites the first megabyte of the hard drive and attempts to corrupt the BIOS flash, not primarily a boot sector replacer.

BExplore.Zip

Explore.Zip (ZippedFiles worm) is a destructive worm that propagates via email and destroys local files, not a boot sector virus.

CMBRCorrect

An MBR virus specifically targets and replaces the Master Boot Record - the first sector of a storage device that contains the bootloader code. By replacing this code with its own malicious instructions, the virus executes before the OS loads, giving it deep system control and making it harder to detect and remove. This class of virus predates partition awareness and is a foundational concept in boot-stage malware.

DNimda

Nimda is a multi-vector worm that spreads through email, web servers, and network shares but does not replace the boot sector with its code.

Concept tested: MBR virus boot sector infection mechanism

Source: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/understanding-malware

Topics

#MBR virus#boot sector#malware types#virus infection

Community Discussion

No community discussion yet for this question.

Full GSLC Practice