Endpoint and device security: the full malware taxonomy, multi-factor authentication, the principle of least privilege, patch management, cryptographic hashing and the critical salting concept, IoT vulnerabilities, and digital forensics chain of custody.
The exam tests precise distinctions between malware types. Memorize the mechanism of each — not just the name.
| Type | Mechanism | Key distinction |
|---|---|---|
| Virus | Attaches to or inserts code into a host file. Spreads when the host file is executed or shared. | Requires a host file — cannot self-propagate independently. |
| Worm | Self-replicating program that spreads across networks without requiring a host file. | Self-propagating — no host file needed. Spreads automatically. |
| Trojan | Disguises itself as legitimate software. When executed, performs malicious actions (installs backdoor, exfiltrates data). | Relies on user deception — does not self-replicate. |
| Ransomware | Encrypts victim's files or entire systems, then demands payment for the decryption key. | Primarily an Availability and Confidentiality attack. |
| Spyware | Secretly monitors user activity and sends data to the attacker (browsing history, keystrokes, screenshots). | Confidentiality attack; operates silently. |
| Adware | Delivers unwanted advertisements; may track browsing. Often bundled with free software. | Least harmful category; may enable more serious spyware. |
| Rootkit | Embeds deeply in the OS or firmware to hide itself and other malware from security tools and the OS itself. | Evasion focus — makes other malware persistent and invisible. |
| Keylogger | Records every keystroke, capturing passwords, credit card numbers, and messages. | Often a component of a larger spyware or trojan payload. |
| Botnet | Network of compromised devices ("bots") controlled by a command-and-control (C2) server. Used for DDoS, spam, credential stuffing. | The device is compromised but may show no obvious symptoms to the owner. |
Exam trap: Virus vs. worm is tested repeatedly. Virus = needs a host file to spread. Worm = no host file, self-propagating across networks. A worm can carry a virus as its payload, but the spreading mechanism determines the classification.
MFA requires a user to provide evidence from two or more distinct factor categories before granting access. Using two passwords is not MFA — both are "something you know."
| Factor | Category | Examples |
|---|---|---|
| Something you know | Knowledge | Password, PIN, security question answer |
| Something you have | Possession | Authenticator app (TOTP), hardware security key (FIDO2), smart card, SMS code |
| Something you are | Inherence (biometric) | Fingerprint, facial recognition, iris scan, voice recognition |
Why MFA defeats credential stuffing and phishing: Even if an attacker obtains a victim's password (via phishing or breach), they cannot authenticate without the second factor (which only the legitimate user possesses or is).
Principle of Least Privilege (PoLP): Every user, process, or system should have the minimum access rights required to perform their function — and nothing more. A payroll clerk does not need access to source code. A web server process does not need write access to the operating system directory.
Role-Based Access Control (RBAC): Permissions are assigned to roles (e.g., "Payroll Clerk," "Network Admin," "Read-Only Auditor"), and users are assigned to roles. This makes permissions manageable at scale: when an employee changes jobs, change their role rather than editing hundreds of individual permissions.
Separation of duties: High-value or high-risk actions require approval or participation from multiple people. A single employee should not be able to both initiate and approve a large financial transfer.
Unpatched software is the most common vulnerability exploited by malware. The vulnerability lifecycle:
Prioritization: Not all patches can be applied immediately. High-severity CVEs (especially those actively exploited in the wild) are patched first; low-severity patches are batched.
A cryptographic hash function takes an input of any size and produces a fixed-size output (the hash or digest). It is a one-way function — given the hash, you cannot recover the original input. Hashes are used to store passwords securely: only the hash is stored, not the plaintext password. At login, the entered password is hashed and compared to the stored hash.
| Algorithm | Output size | Status |
|---|---|---|
| MD5 | 128-bit (32 hex chars) | Broken — collision attacks exist. Not for security use. |
| SHA-1 | 160-bit (40 hex chars) | Deprecated — collision attacks demonstrated. Not for security use. |
| SHA-256 | 256-bit (64 hex chars) | Current standard. Part of the SHA-2 family. |
A rainbow table is a precomputed lookup table mapping common passwords to their hashes. An attacker who steals a hashed password database can look up each hash in the table and immediately find the original password — no cracking needed.
Salting defeats rainbow tables: before hashing, a unique random value (the salt) is appended to each password. The same password hashed with different salts produces completely different hashes. Precomputed tables are useless because no two users' "password123" hashes are the same — an attacker would have to compute a new rainbow table for every possible salt value, which is computationally infeasible.
Exam explanation pattern: "Salting defeats rainbow tables because the salt makes the input to the hash function unique for every user, so precomputed hash tables cannot be used to reverse stored hashes."
Digital forensics is the process of collecting and analyzing digital evidence in a way that is legally admissible and forensically sound.
Original Practice Scenario · Tian2 AP
Scenario: A company's database of user passwords was breached. The database stored passwords as unsalted MD5 hashes. Within hours of the breach, the attacker published plaintext passwords corresponding to the stolen hashes online.
(A) Explain how the attacker was able to recover plaintext passwords from the hashes so quickly.
The attacker used a rainbow table — a precomputed lookup table that maps common passwords to their MD5 hashes. Because the passwords were stored without salting, identical passwords produce identical hashes. The attacker simply looked up each stolen hash in their precomputed table, returning the original password nearly instantly. MD5 is also a deprecated algorithm with known weaknesses that further reduces the computational cost of attack.
(B) Recommend two specific changes to the password storage system and explain how each reduces the risk of a future breach producing the same outcome.
1. Replace MD5 with a password-specific hashing algorithm such as bcrypt or SHA-256 with a high iteration count. bcrypt is intentionally slow, meaning an attacker cannot compute billions of hashes per second even with specialized hardware — dramatically increasing the time required to crack any single password.
2. Add a unique random salt to each password before hashing. Even if two users have identical passwords, their stored hashes will be different. This makes precomputed rainbow table attacks useless, as the attacker would need to generate a separate table for each possible salt value — computationally infeasible at scale.