Classify described behaviour into categories and name the response each implies

short · 30 min · Objective 2.2

Task

Work from described behaviour to category to response. No hostile software is obtained, downloaded or run at any point -- the exercise is the reasoning, and the reasoning is what the exam scores, because a technician meets a description long before they meet a file.

Steps

  1. Write lab/classify/behaviours.csv with header behaviour,category,how_it_spreads,first_response with at least ten described behaviours covering viruses, worms, trojans, ransomware, keyloggers, spyware, adware, rootkits, miners and botnet membership.
  2. For each row, make first_response specific: isolate, rebuild, clean, escalate, or check the network -- not 'run a scan'.
  3. Write lab/classify/spread.md explaining the three-way split between virus, worm and trojan in terms of what each one needs from a person.
  4. Write lab/classify/quiet.md covering the categories whose only symptom is a slow machine, and the two questions that turn that into a security finding rather than a performance complaint.
  5. Write lab/classify/rebuild.md listing the findings that mean rebuild rather than clean, with the reason for each.

Verify

awk -F, 'NR>1 && NF>=4 {n++} END {print n" behaviour(s)"}' lab/classify/behaviours.csv
awk -F, 'NR>1 {print $2}' lab/classify/behaviours.csv | sort -u | wc -l
awk -F, 'NR>1 && $4 ~ /scan/ {n++} END {print n" response(s) that are just a scan"}' lab/classify/behaviours.csv
grep -Eic 'human|person|action|by itself|no user' lab/classify/spread.md
grep -Ec '^[-*0-9]' lab/classify/rebuild.md

Ten behaviours across at least six distinct categories, and four or more rebuild criteria. A first response of "run a scan" on every row is the answer this lab exists to replace.

Notes

The quiet categories are the ones users never report, because the only symptom is a computer that feels old. That framing -- busy when nobody is using it is a security question -- is the most useful sentence in this lesson.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.