An analyst is examining a suspicious binary and wants to identify the exact instructions it will execute, including any conditional jumps and API calls, without running it. Which tool category should the analyst use?

A disassembler such as IDA Pro or Ghidra

A packet analyzer such as Wireshark

A security team is analyzing a suspected botnet client. They need to identify the command-and-control server and the data being exfiltrated. The analysis must be performed in an isolated environment. Which combination of tools is most appropriate?

An antivirus scanner and a firewall

A hex editor and a strings utility

A sandbox and a network protocol analyzer

A company has experienced repeated infections from a new ransomware variant that evades signature-based antivirus. The security team wants to improve detection of unknown malware without relying solely on signatures. Which countermeasure should they implement?

Increase the frequency of antivirus signature updates

Deploy a host-based intrusion detection system that monitors for suspicious behavior

Disable macros in all documents

Block all outbound network traffic

Which artifact is typically examined during static malware analysis?

Registry keys created after running the sample

Network packets captured during execution

Memory dumps taken while the process is active

EC-CouncilCertified Ethical Hacker

Domain 3Objective 8

Malware Analysis and Countermeasures CEH Practice Questions (Page 5)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 21–25

21application · medium
An analyst is examining a suspicious binary and wants to identify the exact instructions it will execute, including any conditional jumps and API calls, without running it. Which tool category should the analyst use?
Select an answer first
22application · medium
A security team is analyzing a suspected botnet client. They need to identify the command-and-control server and the data being exfiltrated. The analysis must be performed in an isolated environment. Which combination of tools is most appropriate?
Select an answer first
23foundation · easy
Which type of tool is used to analyze network traffic generated by malware during dynamic analysis?
Select an answer first
24application · medium
A company has experienced repeated infections from a new ransomware variant that evades signature-based antivirus. The security team wants to improve detection of unknown malware without relying solely on signatures. Which countermeasure should they implement?
Select an answer first
25foundation · easy
Which artifact is typically examined during static malware analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.