An analyst has a suspicious file and must determine whether it is malware. The analyst has a limited time and cannot risk executing it on a production machine. Which approach provides the best balance of speed and safety?

Perform static analysis first, then dynamic analysis in a sandbox if needed

Only use dynamic analysis and skip static analysis

Submit the file to an online forum for other users to test

Immediately run the file on a production machine to observe its behavior

A malware analyst is examining a packed executable. Static analysis shows high entropy in the .text section and a small number of imported functions. The analyst needs to extract the original code for further analysis. Which approach is most appropriate?

Use a PE header editor to change the section flags and force the file to load

Use a network analyzer to capture the unpacked code as it is downloaded

Use a strings utility to extract readable strings from the packed file

Use a debugger to let the malware unpack itself and then dump the process memory

During static analysis of a Windows executable, an analyst finds a suspicious string that appears to be a URL. The analyst wants to determine if this URL is a known malicious indicator without executing the file. Which tool or technique should the analyst use?

Run the executable in a sandbox and capture the URL it contacts

Open the URL in a web browser to see if it is malicious

Use a strings utility to extract the URL and then query a threat intelligence platform

Use a debugger to set a breakpoint on the URL string and observe its usage

Which activity is part of dynamic malware analysis?

Running the sample in a virtual machine and monitoring its network connections

Comparing the file hash against known malware databases

Searching for suspicious strings in the binary

Examining the PE header of the binary

Which countermeasure is most directly aimed at reducing vulnerabilities in software that malware often exploits?

Intrusion detection system (IDS)

EC-CouncilCertified Ethical Hacker

Domain 3Objective 8

Malware Analysis and Countermeasures CEH Practice Questions (Page 3)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 11–15

11application · medium
An analyst has a suspicious file and must determine whether it is malware. The analyst has a limited time and cannot risk executing it on a production machine. Which approach provides the best balance of speed and safety?
Select an answer first
12expert · hard
A malware analyst is examining a packed executable. Static analysis shows high entropy in the .text section and a small number of imported functions. The analyst needs to extract the original code for further analysis. Which approach is most appropriate?
Select an answer first
13application · medium
During static analysis of a Windows executable, an analyst finds a suspicious string that appears to be a URL. The analyst wants to determine if this URL is a known malicious indicator without executing the file. Which tool or technique should the analyst use?
Select an answer first
14foundation · easy
Which activity is part of dynamic malware analysis?
Select an answer first
15foundation · easy
Which countermeasure is most directly aimed at reducing vulnerabilities in software that malware often exploits?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.