Certified Incident Handler (ECIH v3) — Question 18

A Host is infected by worms that propagates through a vulnerable service; the sign(s) of the presence of the worm include:

Answer options

• A. Decrease in network usage
• B. Established connection attempts targeted at the vulnerable services
• C. System becomes instable or crashes
• D. All the above

Correct answer: C

Explanation

The correct answer is C because worms typically cause instability or crashes in the system as they consume resources. Options A and B are incorrect as a decrease in network usage is not a typical sign of a worm infection, and while connection attempts may occur, they are not definitive indicators of a worm's presence.