Instant Messenger Malware Distribution Prevention
Sarah, a system administrator, was alerted of potential malicious activity on the network of her company. She discovered a malicious program spread through the instant messenger application used by her team. The attacker had obtained access to one of her teammate's messenger accounts and started sending files across the contact list. Which best describes the attack scenario and what measure could have prevented it?
Community Votes
54% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core trap is assuming account compromise negates verification; however, the exam expects users to verify unexpected file transfers through alternative channels even if the source appears trusted.
This question examines malware propagation via instant messaging applications and the appropriate user-side mitigation. The correct answer identifies verifying the sender's identity as the key preventive measure against files sent from compromised trusted accounts.
Many candidates choose Insecure Patch Management because they focus on the initial account breach rather than the specific vector of malicious file distribution described in the scenario.
Community Discussion (13 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The attack scenario describes malware spreading through an instant messenger application where a compromised account sends malicious files. Option B correctly identifies the vector (Instant Messenger Applications) and the mitigation: verifying the sender's identity before opening files. This typically involves confirming with the sender via a different channel (e.g., phone call or separate email) if a file seems suspicious, which breaks the chain of trust exploited by the attacker.Why the Other Options Are Wrong
Option A (Insecure Patch Management) addresses software vulnerabilities but does not prevent a user from executing a malicious file sent by a compromised contact. Option C (Rogue/Decoy Applications) refers to fake apps masquerading as legitimate ones, not files sent via IM. Option D (Portable Hardware Media) is irrelevant to network-based instant messaging delivery.Community Comment Notes
Community discussion was split between options A and B. Some users argued that since the account was already compromised, verifying identity is futile. However, others noted that CEH doctrine emphasizes user awareness and out-of-band verification as the primary defense against social engineering within trusted networks. As one commenter noted, "it is an instant messaging application attack is the only answer provided that fits," highlighting the importance of matching the specific vector in the question stem to the option.Exam Strategy
Always match the specific technology mentioned in the scenario (IM) to the option category. Even if the technical premise of 'verification' seems weak against a compromised account, CEH questions often prioritize user behavior controls (like verifying unexpected files) over technical fixes when the vector is clearly identified.
Frequently Asked Questions
Why isn't patching the app the right answer?
Patching prevents exploitation of vulnerabilities but doesn't stop a user from running a malicious file sent by a trusted, compromised contact. Verification is the behavioral control.
Does verifying identity work if the account is hacked?
Yes, indirectly. It forces a second step of confirmation via a different channel, which alerts the recipient that something is wrong even if the sender name looks normal.