A security team is analyzing a sophisticated malware sample. The team has limited time and resources. They need to determine the malware's capabilities and impact. Which analysis strategy is most efficient?

Start with static analysis to gather indicators, then use dynamic analysis to confirm behavior

Perform only static analysis to avoid the risk of executing malware

Skip static analysis and go directly to dynamic analysis

Perform only dynamic analysis to observe real behavior

A security analyst must determine whether a suspicious file is malicious. The analyst has limited time and needs a quick initial assessment. The file appears to be a Windows executable. Which approach provides the fastest initial indication of maliciousness?

Run a strings utility and check for suspicious URLs, IP addresses, and API calls

Upload the file to an online virus total service and wait for all engines to complete

Disassemble the entire binary and manually review every instruction

Perform a full dynamic analysis in a sandbox and review the full report

A malware analyst is using a debugger to analyze a packed binary. The binary unpacks itself at runtime. Which technique should the analyst use to observe the unpacked code?

Use a strings utility on the original file to find hidden strings

Submit the packed binary to an online scanner and wait for the report

Run the binary in a sandbox and only review the network traffic

Set a breakpoint after the unpacking routine and dump the process memory

A malware analyst is examining a suspicious document file that is believed to contain a macro-based dropper. The analyst wants to extract the embedded macro without executing it. Which tool is most appropriate?

A macro analysis tool such as olevba or OfficeMalScanner

A network protocol analyzer such as Wireshark

A PE header analysis tool such as PEiD

A security team is analyzing a suspected keylogger. They need to observe what data it captures and where it sends it. The analysis environment must be isolated from the production network. Which combination of tools and setup is most appropriate?

A debugger running on the analyst's workstation without any network isolation

A physical machine with a mirrored port on the corporate switch

A sandbox that automatically reports to the vendor's cloud

A virtual machine with a virtual network, a packet analyzer, and a process monitor

EC-CouncilCertified Ethical Hacker

Domain 3Objective 8

Malware Analysis and Countermeasures CEH Practice Questions (Page 7)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 31–35

31expert · hard
A security team is analyzing a sophisticated malware sample. The team has limited time and resources. They need to determine the malware's capabilities and impact. Which analysis strategy is most efficient?
Select an answer first
32application · medium
A security analyst must determine whether a suspicious file is malicious. The analyst has limited time and needs a quick initial assessment. The file appears to be a Windows executable. Which approach provides the fastest initial indication of maliciousness?
Select an answer first
33application · medium
A malware analyst is using a debugger to analyze a packed binary. The binary unpacks itself at runtime. Which technique should the analyst use to observe the unpacked code?
Select an answer first
34application · medium
A malware analyst is examining a suspicious document file that is believed to contain a macro-based dropper. The analyst wants to extract the embedded macro without executing it. Which tool is most appropriate?
Select an answer first
35application · medium
A security team is analyzing a suspected keylogger. They need to observe what data it captures and where it sends it. The analysis environment must be isolated from the production network. Which combination of tools and setup is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.