4.2 Exercise 1: Identify the Malware

Lesson 4.2 — Malware · Exercise 1 of 2

Exercise 1: Identify the Malware

Guided Practice · 5 scenarios · Predict first, then check · 20–25 min

🎯 How This Works

Each scenario describes a real-world incident. Before you answer, type a short prediction in the purple box — your best guess based on the observed behavior. Then answer the multiple-choice question and check your reasoning against the feedback.

Why predict first? It forces you to commit to a hypothesis before the options frame your thinking. This is exactly the mental habit AP Cyber MCQs reward.

✎ Guided Practice — 5 Scenarios
Scenario 1 of 5 On Monday morning, employees at a regional accounting firm find that every file on the shared network drive has been renamed with a .locked extension. A text file named README_DECRYPT.txt sits in every folder demanding 12 Bitcoin for recovery. Workstation logs from the prior weekend show a PowerShell process that ran for 4 hours encrypting files.
Predict First In one sentence, what malware category is this and why?
Scenario 2 of 5 A hospital’s SIEM alerts on unusual internal traffic: hundreds of workstations are scanning TCP port 445 of their neighbors, then copying an executable to any system that responds. No user opened an email or clicked a link. Within 90 minutes, half the organization is infected. Which malware category BEST fits?
Predict First What single detail in the scenario most clearly rules OUT a trojan?
Scenario 3 of 5 — Spot the Error in the Help-Desk Report A junior analyst submits this report. Which statement in it is INCORRECT and should be flagged for revision? 
INCIDENT REPORT #4821
User: J. Rivera (Marketing)
Device: MKTG-LAP-22
Event: User downloaded "Free_PDF_Converter_Pro.exe" from a pop-up
       ad. After installing, the converter worked as expected, but
       three hours later our EDR flagged outbound connections from
       the laptop to a known command-and-control IP in Bulgaria.
CLASSIFICATION: Worm (self-spread across marketing VLAN)
RECOMMENDATION: Reimage device.
Predict First Which line is wrong — and what SHOULD it say?
Scenario 4 of 5 — Multi-Select (Which statements are TRUE?) A home router has been compromised. The owner notices nothing unusual but their ISP sends an abuse notice. Consider the following statements about what is likely happening. Select ALL that are TRUE. No credit for selecting incorrect options.
Predict First Without looking at the options, name two realistic things the router could be doing right now.
Scenario 5 of 5 — Terminology Recall Fill in each blank with the correct malware term.
Predict First Before typing, say the terms aloud to yourself. What three words should you be about to write?

1. A embeds itself at kernel or firmware level to hide from antivirus.

2. Malware that runs entirely in memory with no file written to disk is called malware.

3. A vulnerability or malware variant for which no patch or signature exists yet is called a .

0 / 5 Scenarios correct — review any incorrect answers above, then move on to Exercise 2.
📚 Pattern to Remember

Every AP Cyber malware MCQ follows one of three stem patterns: (1) a scenario describes a behavior and asks which category fits; (2) a scenario presents a flawed analyst report and asks which line is incorrect; (3) definitional recall of a specific category or detection strategy. Predict-first is the single habit that lifts your accuracy on type (1) and (2).

← Back to Lesson 4.2 Exercise 2 →
AP Cybersecurity · Unit 4 · Lesson 4.2 · Exercise 1
Lesson•Exercise 1••Lab•Quiz
Back to:Lesson 4.2Unit 4 Study GuideCourse Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours
✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

✉

Email

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]