What is the primary purpose of dynamic malware analysis?

To observe the malware's behavior in a controlled environment

To calculate the malware's hash value

To reverse-engineer the malware's source code

To identify malware without executing it

A company has a mix of legacy and modern systems. They need to implement malware countermeasures that are effective across all systems without disrupting operations. Which approach is most balanced?

Implement a strict allowlist of all software

Deploy a combination of antivirus, application whitelisting, and user training

Deploy only advanced EDR on all systems

Disable all unnecessary services and ports on all systems

A malware analyst is analyzing a sample that uses anti-debugging techniques. The analyst needs to bypass these techniques to observe the malware's behavior. Which approach is most effective?

Use static analysis to manually remove all anti-debugging code

Use a debugger with anti-anti-debugging plugins

Run the malware in a standard sandbox

Use a network analyzer to observe the malware's behavior

An analyst is examining a suspicious PDF file. The analyst wants to check for embedded JavaScript or malicious actions without opening the PDF in a viewer. Which tool or technique should the analyst use?

Use a PDF analysis tool that parses the file structure and extracts scripts

Print the PDF to see if any actions occur

Rename the file to .txt and read it in a text editor

Open the PDF in a web browser to see if it prompts for anything

A company is experiencing infections from a fileless malware that runs in memory. Traditional antivirus is not detecting it. The security team wants to implement a countermeasure that can detect this type of attack. Which approach is most effective?

Deploy endpoint detection and response (EDR) with behavioral monitoring

Increase the frequency of antivirus signature updates

Disable all scripting engines on endpoints

Implement application whitelisting

EC-CouncilCertified Ethical Hacker

Domain 3Objective 8

Malware Analysis and Countermeasures CEH Practice Questions (Page 1)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 1–5

1foundation · easy
What is the primary purpose of dynamic malware analysis?
Select an answer first
2expert · hard
A company has a mix of legacy and modern systems. They need to implement malware countermeasures that are effective across all systems without disrupting operations. Which approach is most balanced?
Select an answer first
3expert · hard
A malware analyst is analyzing a sample that uses anti-debugging techniques. The analyst needs to bypass these techniques to observe the malware's behavior. Which approach is most effective?
Select an answer first
4application · medium
An analyst is examining a suspicious PDF file. The analyst wants to check for embedded JavaScript or malicious actions without opening the PDF in a viewer. Which tool or technique should the analyst use?
Select an answer first
5expert · hard
A company is experiencing infections from a fileless malware that runs in memory. Traditional antivirus is not detecting it. The security team wants to implement a countermeasure that can detect this type of attack. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.