Which countermeasure is most effective at preventing malware from executing by inspecting code before it runs?

Intrusion detection system (IDS)

A malware analyst is analyzing a suspicious binary and wants to identify the malware's persistence mechanism. The analyst has already performed static analysis and found a suspicious registry key modification. Which tool is most appropriate to confirm the persistence mechanism dynamically?

A strings utility such as Sysinternals Strings

A network protocol analyzer such as Wireshark

A registry monitoring tool such as Regshot or ProcMon

An organization wants to reduce the risk of malware infections from email attachments. They already have antivirus and a firewall. Which additional countermeasure would be most effective?

Require users to manually scan every attachment with a different antivirus product

Increase the password complexity policy

Implement email filtering that quarantines attachments with suspicious file types

Disable the firewall to improve network performance

A malware analyst is analyzing a sample that appears to be a dropper. The analyst needs to determine what files it drops and what registry keys it creates. The sample is packed and uses anti-debugging techniques. Which approach is most effective?

Use a debugger to step through the unpacking routine and then set breakpoints on registry APIs

Use static analysis with a strings utility to find file names and registry paths

Submit the sample to an online sandbox and rely solely on its report

Run the sample in a sandbox that monitors file system and registry changes, and then compare snapshots

An analyst is analyzing a malicious document that downloads a second-stage payload. The analyst needs to extract the URL of the payload and also understand the download mechanism. The document is a macro-enabled Office file. Which combination of tools would be most effective?

Use only a debugger to step through the macro code

Use only a hex editor to search for URLs in the raw file

Use a macro analysis tool to extract the macro code, then a packet analyzer to observe the download in a sandbox

Use only a sandbox and ignore the macro code

EC-CouncilCertified Ethical Hacker

Domain 3Objective 8

Malware Analysis and Countermeasures CEH Practice Questions (Page 2)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 6–10

6foundation · easy
Which countermeasure is most effective at preventing malware from executing by inspecting code before it runs?
Select an answer first
7application · medium
A malware analyst is analyzing a suspicious binary and wants to identify the malware's persistence mechanism. The analyst has already performed static analysis and found a suspicious registry key modification. Which tool is most appropriate to confirm the persistence mechanism dynamically?
Select an answer first
8application · medium
An organization wants to reduce the risk of malware infections from email attachments. They already have antivirus and a firewall. Which additional countermeasure would be most effective?
Select an answer first
9expert · hard
A malware analyst is analyzing a sample that appears to be a dropper. The analyst needs to determine what files it drops and what registry keys it creates. The sample is packed and uses anti-debugging techniques. Which approach is most effective?
Select an answer first
10expert · hard
An analyst is analyzing a malicious document that downloads a second-stage payload. The analyst needs to extract the URL of the payload and also understand the download mechanism. The document is a macro-enabled Office file. Which combination of tools would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.