A security team is responding to a malware outbreak. They need to contain the infection while preserving evidence for analysis. The malware is spreading through network shares. Which action should they take first?

Run a full antivirus scan on all systems

Isolate infected systems from the network while keeping them powered on

Power off all infected systems immediately

Delete the malware files from all systems

A development team wants to prevent malware from being introduced through their software supply chain. They use third-party libraries and want to ensure these components are not malicious. Which countermeasure should they implement?

Only use libraries that are popular and widely used

Use a software composition analysis tool to scan dependencies for known vulnerabilities and malicious packages

Rely solely on the antivirus installed on developer workstations

Disable all third-party libraries and write everything from scratch

During static analysis of a suspicious executable, which action is most appropriate?

Extract readable strings and examine the file's import table

Monitor registry changes while the file is running

Run the executable in a debugger to observe its API calls

Submit the file to an online sandbox for automated behavioral report

An organization wants to implement a defense-in-depth strategy against malware. They already have perimeter firewalls and endpoint antivirus. Which additional control would best complement the existing defenses?

Only use a password manager for all users

Remove all firewalls to simplify the network

Deploy an intrusion detection system on the internal network

Disable antivirus to improve system performance

A security analyst is analyzing a worm that spreads over the network. The analyst needs to understand how it propagates and what network ports it uses. Which analysis approach is most appropriate?

Use a disassembler to review the code and guess the ports

Run the worm on the production network and use a packet analyzer

Static analysis only, examining the file's strings for port numbers

Dynamic analysis in a sandbox with network monitoring to observe outbound connections

EC-CouncilCertified Ethical Hacker

Domain 3Objective 8

Malware Analysis and Countermeasures CEH Practice Questions (Page 8)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 36–40

36expert · hard
A security team is responding to a malware outbreak. They need to contain the infection while preserving evidence for analysis. The malware is spreading through network shares. Which action should they take first?
Select an answer first
37application · medium
A development team wants to prevent malware from being introduced through their software supply chain. They use third-party libraries and want to ensure these components are not malicious. Which countermeasure should they implement?
Select an answer first
38foundation · easy
During static analysis of a suspicious executable, which action is most appropriate?
Select an answer first
39application · medium
An organization wants to implement a defense-in-depth strategy against malware. They already have perimeter firewalls and endpoint antivirus. Which additional control would best complement the existing defenses?
Select an answer first
40application · medium
A security analyst is analyzing a worm that spreads over the network. The analyst needs to understand how it propagates and what network ports it uses. Which analysis approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.