A security analyst is investigating a malware outbreak. The malware is a file infector that uses a polymorphic engine to change its code each time it infects a new file. Traditional antivirus has failed to detect it. Which detection strategy would be most effective?

Disable file sharing to prevent the malware from spreading.

Use a honeypot to capture the malware for analysis.

Use behavioral monitoring to detect the malware's file infection activity.

Increase the frequency of signature updates.

Which of the following is NOT a typical persistence technique used by malware?

Placing a shortcut in the Startup folder

An analyst receives a suspicious binary and wants to determine its network behavior without risking the production network. The binary appears packed and resists static analysis. Which approach should the analyst use first?

Submit the binary to an online multi-scanner

Use a debugger to step through the binary's unpacking routine

Perform a string search on the binary to find URLs

Run the binary in a sandboxed virtual machine with network monitoring

Which of the following is an indicator of compromise (IOC) that might be found during malware analysis?

A suspicious registry key added by the malware

The color of the desktop wallpaper

EC-CouncilCertified Ethical Hacker

Domain 3Objective 7

Malware Threats (Trojans, Viruses, Ransomware) CEH Practice Questions (Page 7)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 31–35

31expert · hard
A security analyst is investigating a malware outbreak. The malware is a file infector that uses a polymorphic engine to change its code each time it infects a new file. Traditional antivirus has failed to detect it. Which detection strategy would be most effective?
Select an answer first
32foundation · easy
Which of the following is NOT a typical persistence technique used by malware?
Select an answer first
33application · medium
An analyst receives a suspicious binary and wants to determine its network behavior without risking the production network. The binary appears packed and resists static analysis. Which approach should the analyst use first?
Select an answer first
34foundation · easy
Which of the following is an indicator of compromise (IOC) that might be found during malware analysis?
Select an answer first
35foundation · easy
Which malware detection method relies on known patterns or signatures of malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.