Which statement correctly contrasts static and dynamic malware analysis?

Static analysis requires a virtual machine, while dynamic analysis does not require any controlled environment.

Static analysis inspects the binary without executing it, while dynamic analysis observes behavior during execution.

Static analysis only examines network traffic, while dynamic analysis only examines file hashes.

Static analysis executes the malware in a sandbox, while dynamic analysis inspects the binary without running it.

A malware analyst is examining a suspicious executable and wants to identify the compiler used and whether the file is packed. Which static analysis technique is most appropriate?

Execute the file in a debugger and observe the unpacking routine

Use a PE header analysis tool to examine the file's sections and entropy

Run a network sniffer to capture the file's outbound traffic

Use a memory forensics tool to dump the process memory

A malware analyst has a suspicious file and needs to quickly determine if it is known malware. The analyst has limited time and cannot execute the file. Which initial step is most appropriate?

Compute the file's hash and search it against a threat intelligence database

Upload the file to an online scanner and wait for multiple antivirus results

Disassemble the entire binary and manually review every instruction

Run the file in a sandbox and review the report

An organization wants to reduce the risk of malware infections from email attachments. The security team is considering multiple countermeasures. Which measure is most effective at preventing malware from executing in the first place?

Conducting regular malware analysis on suspicious files

Monitoring network traffic for command-and-control communication

Training users to identify phishing emails

Implementing application whitelisting on endpoints

EC-CouncilCertified Ethical Hacker

Domain 3Objective 8

Malware Analysis and Countermeasures CEH Practice Questions (Page 6)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 26–30

26foundation · easy
Which statement correctly contrasts static and dynamic malware analysis?
Select an answer first
27application · medium
A malware analyst is examining a suspicious executable and wants to identify the compiler used and whether the file is packed. Which static analysis technique is most appropriate?
Select an answer first
28application · medium
A malware analyst has a suspicious file and needs to quickly determine if it is known malware. The analyst has limited time and cannot execute the file. Which initial step is most appropriate?
Select an answer first
29foundation · easy
A security analyst receives a suspicious binary and needs to determine its purpose without executing it. Which approach best describes this activity?
Select an answer first
30application · medium
An organization wants to reduce the risk of malware infections from email attachments. The security team is considering multiple countermeasures. Which measure is most effective at preventing malware from executing in the first place?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.