Cyber Security Quiz: Malware Categories

10 questions · exam conditions

0:00

Malware CategoriesQuestion 1 of 10

Employees receive a link to what appears to be the organization's approved VPN client. The installer displays the expected logo and successfully opens the real VPN website, but it also installs a hidden remote-access component. It does not replicate or demand payment.

Which malware category most directly describes the malicious installer?

A virus, because the installer adds unauthorized code to the employee's computer

A worm, because a web link can distribute the installer to multiple employees

A trojan, because the installer masquerades as trusted software while adding a backdoor

Ransomware, because the backdoor could later be used to deny access to systems

← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Malware Categories

Practice Malware Categories in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Malware Categories, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

Which malware category most directly describes the malicious installer?

A virus, because the installer adds unauthorized code to the employee's computer
A worm, because a web link can distribute the installer to multiple employees
A trojan, because the installer masquerades as trusted software while adding a backdoor (correct answer)
Ransomware, because the backdoor could later be used to deny access to systems

Explanation: When classifying malware, the defining characteristic is how it behaves and spreads, not just what damage it could theoretically cause later. Focus on the mechanism described in the passage: the installer disguises itself as legitimate VPN software, earns the user's trust, then secretly installs a backdoor. That pattern has a specific name. A trojan (choice C) is malware that masquerades as benign or trusted software to trick users into running it, while concealing a malicious payload. The scenario matches this perfectly — the fake installer displays a real logo, opens the real VPN site to avoid suspicion, and hides a remote-access component. No replication, no ransom, just deception plus a hidden backdoor. That's the textbook trojan definition. Choice A is tempting because the installer does add unauthorized code, but a virus specifically requires attaching itself to existing files and replicating through that mechanism. The passage describes no file infection or self-replication, so "virus" is the wrong category. Choice B misidentifies the delivery method as the classification. A worm self-replicates and spreads autonomously across networks without user interaction. Here, the link merely distributes the installer — humans have to click and run it. Distribution via a link is not the same as autonomous worm propagation. Choice D confuses potential future misuse with the malware's actual category. Ransomware encrypts data and demands payment. The passage explicitly states no payment is demanded, and "could later deny access" is speculation, not classification criteria. Your study tip: always classify malware by its primary mechanism, not its side effects or delivery vehicle. Trojans = disguise. Worms = self-spread. Viruses = file infection. Ransomware = encryption + extortion.

Question 2

A program replaces the normal desktop with a full-screen message and prevents the user from opening applications. It promises an unlock code after payment. Examination shows that the user's files remain unencrypted and unchanged.

How should the program be classified based on its primary behavior?

As a trojan, because every program that blocks applications relies on user deception
As ransomware, because it denies system access and conditions restoration on payment (correct answer)
As a virus, because replacing the desktop means the program infected operating-system files
As a worm, because a locked computer may prevent access to shared network resources

Explanation: When classifying malware, focus on what the malware actually does, not surface-level details about how it looks or what side effects it might cause. The key behaviors to identify are: Does it encrypt files? Does it replicate? Does it disguise itself? Does it deny access and demand payment? Here, the program takes over the screen, blocks application access, and demands payment for an unlock code — but critically, it leaves files completely intact. This is classic screen-locker ransomware. Ransomware is defined by two core traits: it denies the user access to their system or data, and it conditions restoration on payment. The program satisfies both criteria perfectly, making B the correct classification. A is wrong because trojans are defined by disguise — they masquerade as legitimate software to trick users into running them. While deception can be involved in delivering ransomware, "blocking applications" is not what makes something a trojan. The reasoning in A invents a rule that doesn't exist in malware taxonomy. C is wrong because viruses are defined by self-replication by attaching to or infecting other files. Replacing a desktop wallpaper or shell does not constitute infecting OS files in the viral sense. The program isn't spreading copies of itself into other executables. D is wrong because worms spread autonomously across networks. A locked computer potentially affecting network access is an incidental side effect, not a defining behavioral characteristic of the malware itself. Your study tip: always classify malware by its primary mechanism, not its secondary consequences. Ransomware = access denial + payment demand, regardless of whether files are encrypted or just locked.

Question 3

Investigators recover a malicious program that deletes event logs and business files after execution. They do not yet know how it reached the system. They find no ransom demand, no evidence that it copies itself, and no indication that it was presented as legitimate software.

Which classification conclusion is most defensible at this stage?

Ransomware is established because deleting files denies victims access to their information
A virus is established because deleting or changing files constitutes host-file infection
None of the four categories is established because damage alone reveals no defining mechanism (correct answer)
A trojan is established because the absence of self-replication rules out only a worm

Explanation: When classifying malware, you must anchor each category to its defining mechanism, not just its observable effects. Damage, disruption, or harmful intent alone cannot establish which category a sample belongs to — you need structural evidence about how the malware operates. That's why C is the most defensible conclusion. The investigators know the program deletes logs and files, but they haven't determined how it arrived or how it behaves beyond execution. Without that information, none of the four classic categories — virus, worm, trojan, or ransomware — can be confirmed, because each requires a specific defining trait that the evidence doesn't yet support. Answer A fails because ransomware isn't defined by denying access through deletion — it's defined by encrypting files and demanding payment. No ransom demand was found, so this classification collapses immediately regardless of the file damage. Answer B misapplies the virus definition. A virus is defined by self-replication through host-file infection — attaching its code to legitimate files to propagate. Deleting or modifying files is a payload behavior, not the infection mechanism that makes something a virus. Damage ≠ infection. Answer D commits a logical error: it assumes eliminating one category (worm, due to no self-copying) automatically establishes another (trojan). But a trojan requires evidence the program was disguised as legitimate software to trick a user. No such evidence exists here. Ruling out what something isn't doesn't prove what it is. Study tip: On malware classification questions, always ask "what is the defining mechanism of this category?" — not "what damage does it cause?" Effects can overlap; mechanisms are what differentiate the categories.

Question 4

A user downloads a counterfeit media-codec package. The package installs a working codec so videos play normally, but it also installs a separate process. Two days later, that separate process encrypts the user's files and requests payment.

Which classification most specifically applies to the counterfeit codec package itself?

A virus, because the package drops additional executable files, which constitutes infecting the host system
A worm, because codec packages are commonly downloaded by many unrelated users across different systems
A trojan, because the package appears useful while concealing a malicious installation (correct answer)
Ransomware, because the package ultimately causes file encryption and presents a payment demand to the user

Explanation: When classifying malware, the key is to focus on what the software pretends to be and how it gains access, not just what damage it eventually causes. Different malware types are defined by their delivery mechanism and behavior, and questions like this test whether you can separate those definitions precisely. The codec package earns its classification as a trojan — option C — because it masquerades as a legitimate, functional piece of software to trick the user into voluntarily installing it. The word "trojan" comes from the Trojan Horse: something that appears benign or useful while smuggling something malicious inside. The codec even works correctly, which is classic trojan behavior — maintaining the illusion of legitimacy while executing a hidden agenda. Option A is tempting but wrong. A virus requires attaching itself to existing files and replicating through them. Dropping additional files during installation is not the same as viral self-replication — that's just a multi-component installer. Option B misidentifies the malware as a worm. Worms spread autonomously across networks without user interaction. The codec requires a user to download and install it, so autonomous propagation doesn't apply here. Option D is the most seductive trap. Yes, the payload is ransomware — but the question asks about the classification of the codec package itself, not the malware it delivers. The package is the delivery vehicle, not the ransomware. Study tip: When a question asks you to classify a piece of malware, always identify the delivery mechanism separately from the payload. Trojans deliver payloads; the payload has its own classification.

Question 5

A phishing message persuades one employee to launch a malicious attachment. After that initial execution, the program scans internal address ranges, exploits an SMB vulnerability, transfers a standalone executable to each vulnerable computer, and remotely starts it without further user action. Heavy scanning temporarily makes several shared services unavailable.

Which feature should control the malware's primary classification?

The deceptive initial email, which makes the complete outbreak a trojan campaign
The autonomous post-execution propagation, which supports classification as a worm (correct answer)
The repeated execution of one program, which supports classification as a virus
The temporary service unavailability, which supports classification as ransomware

Explanation: When classifying malware, the defining characteristic is the mechanism that drives its core behavior — specifically, how it spreads and executes. Don't let secondary behaviors or the initial delivery method distract you from the primary classification trigger. Here, after the initial execution, the program independently scans network ranges, exploits an SMB vulnerability, copies itself to other machines, and launches itself — all without any additional user interaction. That autonomous, self-propagating behavior is the textbook definition of a worm. Worms spread across networks under their own power, requiring no host file and no human to click anything again. Answer B correctly identifies this as the controlling feature. Answer A tempts you by focusing on the phishing email used for delivery. A trojan is defined by disguising itself as legitimate software to trick users — that describes the initial lure, not the malware's dominant post-execution behavior. Delivery method ≠ classification. Answer C incorrectly maps "one program running on many machines" to a virus. Viruses are defined by infecting existing host files and piggybacking on them to spread — this malware transfers a standalone executable, not a parasitic file infection. Answer D latches onto the service disruption and calls it ransomware. Ransomware encrypts data and demands payment for decryption. Temporary unavailability from network scanning is a side effect of propagation activity, not a ransom-based attack. Study tip: On malware classification questions, always ask how does it spread? Worm = self-propagating over a network. Virus = infects host files. Trojan = disguise-based delivery. Ransomware = encrypts and extorts. Match the mechanism, not the side effect.

Question 6

A counterfeit inventory utility appears on 40 computers after administrators independently install it from a compromised internal software portal. Each installation opens a hidden backdoor. Network evidence shows that installed copies never discover other hosts, exploit them, or transmit additional copies.

Why is classifying the utility as a trojan rather than a worm most appropriate?

The utility establishes persistence, while worms are unable to remain active after a reboot
The utility uses a portal, while worms can spread only through removable storage devices
The utility opens a backdoor, while worms cannot contain remote-access functionality
The utility spreads through deceptive human installation rather than autonomous replication (correct answer)

Explanation: When classifying malware, the defining trait of each category lies in its propagation mechanism, not its payload. Trojans disguise themselves as legitimate software and rely on humans to install them. Worms, by contrast, self-replicate autonomously across networks without any user action. Keeping this distinction front and center will help you cut through distractors that focus on what the malware does rather than how it spreads. In this scenario, the utility reaches 40 machines because administrators each independently chose to install it from a portal they believed was trustworthy — classic trojan behavior. The passage explicitly tells you the installed copies never discover other hosts, exploit them, or transmit additional copies. Without autonomous replication, the "worm" label simply doesn't fit. D correctly identifies this: deceptive human installation versus self-propagation is the core taxonomic difference. A is wrong because persistence through reboots is not what separates trojans from worms — worms can absolutely establish persistence too. This answer invents a false limitation of worms. B is wrong because worms are not restricted to removable storage; they spread through networks, email attachments, vulnerabilities, and more. Limiting worms to physical media reflects a serious misconception. C is wrong because backdoor functionality is a payload feature, not a classification criterion. Worms can absolutely carry remote-access payloads, so the presence of a backdoor says nothing about whether something is a trojan or a worm. As a study tip, remember: trojans deceive, worms replicate. When a malware question describes human-initiated installation under false pretenses, think trojan — regardless of what the payload does afterward.

Question 7

Malware enters through an exposed server, scans for additional vulnerable servers, and transmits functioning copies of itself without user assistance. On each compromised server, it encrypts business files and displays a cryptocurrency payment demand.

Which statement most accurately characterizes this malware?

It is only a virus because encrypting files constitutes modification of host files
It is only a trojan because obtaining unauthorized access is inherently deceptive
It is only ransomware because ransomware cannot also propagate autonomously
It combines worm-like propagation with a ransomware extortion payload (correct answer)

Explanation: When classifying malware, you need to recognize that a single malicious program can exhibit characteristics of multiple malware categories simultaneously — this is one of the most common traps on cybersecurity exams. Don't let a question's description of one behavior make you forget the others. The passage describes three distinct behaviors: autonomous propagation across a network by exploiting vulnerable servers, operation without any user interaction, and file encryption paired with a ransom demand. The first two behaviors are the defining traits of a worm — self-replicating code that spreads independently across systems. The third is the hallmark of ransomware — malware that holds data hostage for payment. Because both sets of behaviors are present, D is correct: this malware is a hybrid that combines worm-like propagation with a ransomware payload. Real-world examples like WannaCry and NotPetya followed exactly this pattern. Answer A is wrong because file encryption alone doesn't make something a virus. A virus specifically requires attaching to a legitimate host file to propagate — that mechanism isn't described here. Answer B misidentifies the malware as a trojan. Trojans disguise themselves as legitimate software to trick users into executing them; this malware exploits server vulnerabilities autonomously, with no deception of a user required. Answer C makes a false categorical claim — ransomware absolutely can include self-propagation. There is no rule that prevents malware from combining a delivery mechanism (worm) with a payload type (ransomware). Your study tip: memorize malware types by their defining mechanism, not just their effect. Propagation method, user interaction requirement, and payload type are three separate axes — a single sample can score on all three.

Question 8

An attachment named "Q3-Invoice.pdf.exe" displays a document icon. When opened, it overwrites local files with random data and deletes recovery information. It provides no payment instructions, contact address, or other opportunity to recover the data.

Which conclusion is best supported by the available evidence?

It is a trojan because the misleading filename and icon establish deceptive presentation, and the absence of a ransom demand rules out ransomware (correct answer)
It is a virus because overwriting many files with new data is functionally equivalent to inserting viral code into those files
It is a worm because successfully corrupting multiple files on a system demonstrates the ability to self-replicate
It is ransomware because rendering files inaccessible through overwriting satisfies the access-denial requirement, even without an extortion demand

Explanation: When classifying malware, you need to match the defining characteristics of each malware type against the evidence — not just find one overlapping trait. Each category has necessary conditions, and a single missing condition can disqualify a classification entirely. The malware here shows two critical behaviors: deceptive presentation (a .exe disguised with a PDF name and document icon) and pure destructive payload with no ransom demand. This perfectly fits a trojan — malware that masquerades as something benign to trick the user into executing it. The absence of payment instructions isn't a gap in the evidence; it's meaningful evidence itself. Ransomware requires an extortion mechanism because financial gain is its defining purpose. Without it, the ransomware classification collapses. Answer A is correct because it uses both positive evidence (deception = trojan characteristic) and negative evidence (no ransom = not ransomware) together to reach a sound conclusion. Answer B fails because overwriting files is destruction, not infection. A virus inserts its own replicating code into existing files — the files survive, altered. Destroying a file's contents is categorically different from infecting it. Answer C confuses file corruption with self-replication. A worm spreads copies of itself across systems or networks autonomously; corrupting multiple local files demonstrates nothing about self-propagation. Answer D commits the most tempting error — it correctly notes that overwriting denies access, but ransomware is defined by its ransom component. Removing the extortion demand doesn't leave you with a ransomware variant; it leaves you with a different threat entirely. Study tip: When a question removes a defining feature of a malware type, treat that absence as disqualifying evidence — not just a missing detail.

Question 9

A malicious macro is embedded in a spreadsheet. When an infected spreadsheet is opened, the macro places itself into other spreadsheet files accessible to that user. Those files can later reach other users through a shared folder, but the macro cannot initiate network connections or run independently of a document.

Which category best fits the macro?

A virus, because it infects document hosts and spreads when infected documents execute (correct answer)
A worm, because infected documents can eventually appear in a shared network folder
A trojan, because users may believe the spreadsheet contains legitimate business data
Ransomware, because infected documents may become unavailable during incident containment

Explanation: When classifying malware, focus on how it spreads and whether it can act independently — these two criteria separate viruses, worms, and trojans from each other. The macro described here does exactly what a virus does by definition: it requires a host file (the spreadsheet), it replicates by copying itself into other host files, and it depends on a user executing an infected document to spread. It cannot initiate network connections on its own and cannot run without a document — both critical constraints. Answer A is correct because it precisely captures this host-dependent, execution-triggered replication behavior. Answer B is the most tempting distractor. Yes, infected files end up in a shared folder — but that's passive spread via a human action, not the macro autonomously traversing the network. A worm's defining trait is self-initiated network propagation without needing a user to open a file. Since this macro can't initiate network connections at all, "worm" doesn't fit, regardless of where the files land. Answer C misapplies the trojan definition. A trojan disguises itself as legitimate software to trick users into running it — deception is the core mechanism. While users might incidentally believe the file is legitimate, that's not the mechanism of infection described; the macro's behavior is about replication, not disguise. Answer D invents a ransomware classification. Ransomware encrypts or locks files for extortion. Nothing in the passage mentions encryption, ransom demands, or data lockout — "unavailable during containment" describes an incident response outcome, not malware behavior. Study tip: Always ask two questions about any malware scenario — Does it need a host? (virus yes, worm no) and Can it spread itself across a network independently? (worm yes, virus no). Those two questions alone resolve most virus-vs-worm questions.

Question 10

After one employee runs a downloaded program, the program enumerates reachable systems, exploits an unpatched network service, and launches a standalone copy of itself on each vulnerable host. The copies repeat the process. Investigators find no evidence that the program inserts code into existing files.

Which classification is best supported by the propagation evidence?

A virus, because execution began when the employee ran a downloaded file
A worm, because it autonomously discovers targets and launches independent copies (correct answer)
A trojan, because the first system was compromised through a downloaded program
Ransomware, because simultaneous execution across systems can disrupt network services

Explanation: When classifying malware, focus on propagation mechanism — how the malware spreads — rather than how it first appeared on the initial system. This question gives you three key behavioral clues: the program enumerates reachable hosts, exploits them independently, and launches standalone copies of itself without modifying existing files. That fingerprint points directly to a worm. A worm, by definition, self-propagates across networks by finding vulnerable targets and copying itself as an independent process — no host file needed. The passage explicitly states no code is inserted into existing files, and the copies repeat the enumeration cycle autonomously. That's textbook worm behavior, making B the well-supported answer. A is a trap because it focuses on how the employee triggered the initial infection (running a downloaded file) rather than how the malware spreads. A virus propagates by injecting its code into existing files — the passage directly contradicts this by noting no file insertion occurs. Execution method ≠ classification. C misapplies the trojan definition. A trojan disguises itself as legitimate software to deceive the user into running it. The passage gives no indication the program misrepresented its purpose, and more importantly, trojans don't self-replicate at all. D confuses impact with classification. Ransomware encrypts files or extorts victims — the passage describes neither. Simultaneous execution disrupting services describes a possible side-effect, not a defining characteristic of ransomware. Your study tip: on malware classification questions, always identify the propagation method first — file infection (virus), self-copying across networks (worm), deception without replication (trojan), or payload-based extortion (ransomware).