Instant Messenger Malware Distribution Prevention

312-50v12 By islever Editorial Last updated

Malware Threats

Short answer

B Instant Messenger Applications; verifying the sender's identity before opening any files

Question

Sarah, a system administrator, was alerted of potential malicious activity on the network of her company. She discovered a malicious program spread through the instant messenger application used by her team. The attacker had obtained access to one of her teammate's messenger accounts and started sending files across the contact list. Which best describes the attack scenario and what measure could have prevented it?
  1. Insecure Patch Management; updating application software regularly
  2. Instant Messenger Applications; verifying the sender's identity before opening any files Correct Answer
  3. Rogue/Decoy Applications; ensuring software is labeled as TRUSTED
  4. Portable Hardware Media/Removable Devices; disabling Autorun functionality

Key Takeaways

The core trap is assuming account compromise negates verification; however, the exam expects users to verify unexpected file transfers through alternative channels even if the source appears trusted.

This question examines malware propagation via instant messaging applications and the appropriate user-side mitigation. The correct answer identifies verifying the sender's identity as the key preventive measure against files sent from compromised trusted accounts.

Common mistake: Many candidates choose Insecure Patch Management because they focus on the initial account breach rather than the specific vector of malicious file distribution described in the scenario.

Expert Analysis

Why the Answer Is Correct

The attack scenario describes malware spreading through an instant messenger application where a compromised account sends malicious files. Option B correctly identifies the vector (Instant Messenger Applications) and the mitigation: verifying the sender's identity before opening files. This typically involves confirming with the sender via a different channel (e.g., phone call or separate email) if a file seems suspicious, which breaks the chain of trust exploited by the attacker.

Why the Other Options Are Wrong

Option A (Insecure Patch Management) addresses software vulnerabilities but does not prevent a user from executing a malicious file sent by a compromised contact. Option C (Rogue/Decoy Applications) refers to fake apps masquerading as legitimate ones, not files sent via IM. Option D (Portable Hardware Media) is irrelevant to network-based instant messaging delivery.

Community Comment Notes

Community discussion was split between options A and B. Some users argued that since the account was already compromised, verifying identity is futile. However, others noted that CEH doctrine emphasizes user awareness and out-of-band verification as the primary defense against social engineering within trusted networks. As one commenter noted, "it is an instant messaging application attack is the only answer provided that fits," highlighting the importance of matching the specific vector in the question stem to the option.

Exam Strategy

Always match the specific technology mentioned in the scenario (IM) to the option category. Even if the technical premise of 'verification' seems weak against a compromised account, CEH questions often prioritize user behavior controls (like verifying unexpected files) over technical fixes when the vector is clearly identified.

Frequently Asked Questions

Why isn't patching the app the right answer?

Patching prevents exploitation of vulnerabilities but doesn't stop a user from running a malicious file sent by a trusted, compromised contact. Verification is the behavioral control.

Does verifying identity work if the account is hacked?

Yes, indirectly. It forces a second step of confirmation via a different channel, which alerts the recipient that something is wrong even if the sender name looks normal.

More 312-50v12 FAQ →

Community Votes

B
54%
A
46%

54% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. ryotan 👍 4 Answered A
    It should not be B, as the attacker obtained access to one of the teammate's messenger accounts, so even if you verify the sender's identity, it is not a fake account, it does not help. A is the option for me.
  2. anarchyeagle 👍 2
    Chat GPT: Verifying the sender's identity before opening any files is a crucial preventive measure in this context. This can involve double-checking with the sender through a different communication channel before opening unexpected files or links, even if they appear to come from someone you know. This measure helps to mitigate the risk of similar attacks by ensuring that the files or links are genuinely intended and safe to open.
  3. przemyslaw1 👍 2 Answered B
    B. Instant Messenger Applications; verifying the sender's identity before opening any files CEH book, Module 7 - Different Ways for Malware to Enter a System.
  4. LordXander 👍 1 Answered B
    Okay, I will be the one saying C..I know...it might be stupid/wrong but hear me out. So, after some discussions with a few cyber experts, we agreed that both B and C could be the correct options, it really depends on your angle. For option B, the arguments is that the verification could be something set, server side, such as a 2FA(you send a file, you must auth with 2FA) -> valid idea, a bit uncommon, but valid For option C - the idea of having files scanned before being sent by different solutions and then marked as TRUSTED is another way of approaching this since 2FA can be bypassed (looking at MS). So after even more deliberations, if I had this question, I would go with option B as it covers more ground (software fails, but an email protection service fails more often than 2FA)
  5. GK2205 👍 1 Answered B
    Seems like a trick question given the sender was technically already a "Trusted" third party to the contacts on the other teammates list. However, if you read the answers closely, the only contextual reference to instant messenger is B. The trick in the question is in the section after "Instant Messenger applications" referring to Validation, I think they do this to deliberately throw you off.
Show 8 more comments
  1. r3vrnd 👍 1
    B is the correct answer. This Question is 2 questions... What is this attack an example of, and how to mitigate. it is an instant messaging application attack is the only answer provided that fits from question, even if answer A would fix the initial entry, this isnt what the question wants
  2. Thranduil1789 👍 1 Answered A
    The scenario involves an attacker gaining unauthorized access to a teammate’s account and using it to distribute malicious files to the contact list.t. Verifying the identity may not help if the sender is indeed a trusted teammate.
  3. Bas375 👍 1
    B - Opening files from unknown source should be verified e.g. the attacker that compromise the account if that make sense
  4. insaniunt 👍 1 Answered B
    B. Instant Messenger Applications; verifying the sender's identity before opening any files
  5. calx5 👍 1 Answered A
    Question mentioned that account was compromised
  6. DruSuperman 👍 1 Answered B
    B is the only one that makes sense.
  7. LoveBug4 👍 1 Answered B
    Module 7, page 948
  8. pechuga 👍 1
    A option for me

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide