What is the purpose of packing in malware?

To compress the malware and change its signature to evade detection

To increase the size of the malware file

To ensure the malware is compatible with all operating systems

A company wants to protect against ransomware that spreads via SMB shares. They have implemented network segmentation, but the ransomware is still spreading within a single segment. Which additional control is most effective?

Use a firewall to block all inbound SMB traffic

Enable SMB signing and disable SMBv1 on all systems

Implement application whitelisting on all servers

Increase the frequency of antivirus signature updates

An analyst is analyzing a malware sample that is packed and uses anti-debugging techniques. The analyst needs to extract the malware's configuration data, including the command-and-control server address. Which approach is most likely to succeed?

Submit the sample to an online multi-scanner

Use a debugger to step through the unpacking routine and then dump the process memory

Perform static analysis on the packed binary to find the C2 address

Run the malware in a sandbox and capture network traffic to identify the C2 address

What is the primary difference between static and dynamic malware analysis?

Static analysis is used for network traffic, while dynamic analysis is used for file analysis

Static analysis is faster than dynamic analysis

Static analysis examines the code without executing it, while dynamic analysis executes the malware in a controlled environment

Static analysis requires a sandbox, while dynamic analysis does not

A malware analyst is examining a sample that uses a custom packer and contains anti-debugging code. The analyst wants to determine the malware's capabilities without triggering the anti-debugging defenses. Which approach is most appropriate?

Perform static analysis on the packed binary

Run the sample in a sandbox that hides debugging artifacts from the malware

Use a debugger to step through the unpacking routine

Submit the sample to an online multi-scanner

EC-CouncilCertified Ethical Hacker

Domain 3Objective 7

Malware Threats (Trojans, Viruses, Ransomware) CEH Practice Questions (Page 10)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 46–50

46foundation · easy
What is the purpose of packing in malware?
Select an answer first
47expert · hard
A company wants to protect against ransomware that spreads via SMB shares. They have implemented network segmentation, but the ransomware is still spreading within a single segment. Which additional control is most effective?
Select an answer first
48expert · hard
An analyst is analyzing a malware sample that is packed and uses anti-debugging techniques. The analyst needs to extract the malware's configuration data, including the command-and-control server address. Which approach is most likely to succeed?
Select an answer first
49foundation · easy
What is the primary difference between static and dynamic malware analysis?
Select an answer first
50application · medium
A malware analyst is examining a sample that uses a custom packer and contains anti-debugging code. The analyst wants to determine the malware's capabilities without triggering the anti-debugging defenses. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.