A security analyst receives a suspicious executable from an internal user. The analyst must determine whether the file is malicious without executing it, and the analysis must be completed using only tools available on a standard Windows workstation. Which approach should the analyst take?

Inspect file metadata, extract strings, and review the import table

Run the executable in a sandbox and capture its network traffic

Disassemble the binary with a debugger to step through its instructions

Submit the file to an online multi-scanner and wait for the report

A malware analyst needs to capture the network traffic generated by a suspicious executable during dynamic analysis. The analysis environment is a virtual machine. Which tool should the analyst use to capture and review the traffic?

A file integrity monitor such as Tripwire

A packet analyzer such as Wireshark running on the host or VM

A malware analyst is working on a suspected keylogger. The analyst needs to understand the API calls the malware makes to capture keystrokes. Which tool is most appropriate for this analysis?

A strings utility such as Sysinternals Strings

A debugger such as OllyDbg or x64dbg

A PE header analysis tool such as PEiD

A network protocol analyzer such as Wireshark

An analyst is performing static analysis on a Windows executable and notices that the file has a valid digital signature from a reputable software vendor. However, the file is behaving suspiciously in a sandbox. What should the analyst conclude?

The file is definitely safe because the signature is valid

The sandbox is malfunctioning because the file is signed

The digital signature may be legitimate, but the file could still be malicious or compromised

The signature is likely forged because the file behaves suspiciously

EC-CouncilCertified Ethical Hacker

Domain 3Objective 8

Malware Analysis and Countermeasures CEH Practice Questions (Page 4)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 16–20

16application · medium
A security analyst receives a suspicious executable from an internal user. The analyst must determine whether the file is malicious without executing it, and the analysis must be completed using only tools available on a standard Windows workstation. Which approach should the analyst take?
Select an answer first
17application · medium
A malware analyst needs to capture the network traffic generated by a suspicious executable during dynamic analysis. The analysis environment is a virtual machine. Which tool should the analyst use to capture and review the traffic?
Select an answer first
18application · medium
A malware analyst is working on a suspected keylogger. The analyst needs to understand the API calls the malware makes to capture keystrokes. Which tool is most appropriate for this analysis?
Select an answer first
19foundation · easy
Which tool is specifically designed to execute malware in an isolated environment and automatically generate a behavioral report?
Select an answer first
20expert · hard
An analyst is performing static analysis on a Windows executable and notices that the file has a valid digital signature from a reputable software vendor. However, the file is behaving suspiciously in a sandbox. What should the analyst conclude?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.