3.3 Apply the Concepts and Sequence of Steps in the Malware Analysis Process 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In reverse engineering, what is the purpose of disassembling a malware binary?

   • ATo convert machine code into assembly language for analysis
   • BTo execute the binary in a controlled environment
   • CTo decompress the binary's packed code
   • DTo identify the file's hash and signature
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   When setting up a sandbox for malware analysis, which practice helps reduce the chance of malware escaping the controlled environment?

   • AUsing the same user account as the host system
   • BUsing a virtual machine with network isolation
   • CDisabling all security features on the host
   • DConnecting the sandbox directly to the production network
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A malware analyst has a PCAP file that contains an HTTP download of a suspicious binary. Which step is the FIRST in the process of extracting the malware sample from the PCAP?

   • AIdentify the relevant TCP stream or session that carried the file
   • BCalculate the file's hash to identify it
   • CRun the binary in a sandbox to observe its behavior
   • DDisassemble the binary to analyze its code
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A malware analyst is using a sandbox to analyze a sample that is known to delay its malicious activity until a specific date. The sandbox report shows no malicious behavior. What is the most likely reason for the lack of findings?

   • AThe malware is a false positive and is actually benign.
   • BThe sandbox does not have internet access, so the malware cannot connect to its C2 server.
   • CThe sandbox is running as a non-admin user, preventing the malware from executing.
   • DThe sandbox clock is set to the current date, but the malware is waiting for a future date.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   You have completed the analysis of a keylogger. Your report must include the data exfiltration method and the persistence mechanism. Which section of the report should contain this information?

   • ABehavioral analysis section, because it describes what the malware does.
   • BAppendix, because it is supplementary material.
   • CExecutive summary, because it is high-level.
   • DIndicators of compromise section, because it lists IOCs.
   Reveal Solution Discussion Select an answer first