CompTIA Security+ Malware Analysis
and Defense Test Exam Questions
(Actual Exam 2026-2027) Correct
Detailed & Verified ANSWERS (100%
Accurate Solutions) ALREADY GRADED
A+||NEWEST VERSION Of The Exam
Guarantee Pass!!
1. Which type of malware is designed to replicate itself across
networks without requiring user interaction?
A. Trojan
B. Spyware
C. Worm
D. Rootkit
Worms are self-replicating malware that can spread automatically
across systems and networks without needing a user to execute
them.
2. A malicious program disguised as a legitimate application is
known as a:
A. Virus
B. Trojan
C. Worm
D. Logic bomb
,A Trojan disguises itself as legitimate software to trick users into
installing or executing it.
3. Which malware type encrypts files and demands payment for
decryption?
A. Adware
B. Rootkit
C. Ransomware
D. Keylogger
Ransomware encrypts data and requires victims to pay a ransom to
regain access.
4. What is the primary purpose of a rootkit?
A. Display advertisements
B. Steal browser cookies
C. Hide malicious activity from detection
D. Encrypt files
Rootkits modify system components to conceal malware and
maintain privileged access.
5. Which tool is commonly used to analyze malware behavior in a
controlled environment?
A. Firewall
B. Proxy server
C. Sandbox
D. Load balancer
A sandbox isolates malware execution so analysts can observe
behavior safely.
, 6. Static malware analysis involves:
A. Running malware on a live network
B. Examining malware without executing it
C. Deleting infected files
D. Monitoring user activity
Static analysis examines code, strings, headers, and signatures
without running the malware.
7. Dynamic malware analysis requires:
A. Removing malware manually
B. Reviewing documentation
C. Executing malware in a controlled environment
D. Changing firewall rules
Dynamic analysis observes malware actions while it runs.
8. Which malware component allows attackers to remotely control
infected systems?
A. Antivirus engine
B. Command and control (C2)
C. Patch manager
D. Hypervisor
C2 infrastructure allows attackers to communicate with compromised
devices.
9. A botnet is:
and Defense Test Exam Questions
(Actual Exam 2026-2027) Correct
Detailed & Verified ANSWERS (100%
Accurate Solutions) ALREADY GRADED
A+||NEWEST VERSION Of The Exam
Guarantee Pass!!
1. Which type of malware is designed to replicate itself across
networks without requiring user interaction?
A. Trojan
B. Spyware
C. Worm
D. Rootkit
Worms are self-replicating malware that can spread automatically
across systems and networks without needing a user to execute
them.
2. A malicious program disguised as a legitimate application is
known as a:
A. Virus
B. Trojan
C. Worm
D. Logic bomb
,A Trojan disguises itself as legitimate software to trick users into
installing or executing it.
3. Which malware type encrypts files and demands payment for
decryption?
A. Adware
B. Rootkit
C. Ransomware
D. Keylogger
Ransomware encrypts data and requires victims to pay a ransom to
regain access.
4. What is the primary purpose of a rootkit?
A. Display advertisements
B. Steal browser cookies
C. Hide malicious activity from detection
D. Encrypt files
Rootkits modify system components to conceal malware and
maintain privileged access.
5. Which tool is commonly used to analyze malware behavior in a
controlled environment?
A. Firewall
B. Proxy server
C. Sandbox
D. Load balancer
A sandbox isolates malware execution so analysts can observe
behavior safely.
, 6. Static malware analysis involves:
A. Running malware on a live network
B. Examining malware without executing it
C. Deleting infected files
D. Monitoring user activity
Static analysis examines code, strings, headers, and signatures
without running the malware.
7. Dynamic malware analysis requires:
A. Removing malware manually
B. Reviewing documentation
C. Executing malware in a controlled environment
D. Changing firewall rules
Dynamic analysis observes malware actions while it runs.
8. Which malware component allows attackers to remotely control
infected systems?
A. Antivirus engine
B. Command and control (C2)
C. Patch manager
D. Hypervisor
C2 infrastructure allows attackers to communicate with compromised
devices.
9. A botnet is:
