Which of the following is an example of a persistence mechanism that malware might use?

Deleting the malware's own executable after execution

A forensic analyst has completed the analysis of a banking trojan and needs to write a report for the organization's security team. Which of the following is the most important to include in the report?

The full source code of the malware

A list of indicators of compromise (IOCs), observed behavior, and recommended mitigation steps

The analyst's personal opinion about the malware's sophistication

The malware's file hash and a link to a public sandbox report

A forensic analyst has completed a malware analysis and must write a report for both technical and executive audiences. Which of the following is the best approach?

Write a single technical report with all details, including IOCs and code snippets

Write only an executive summary with high-level findings

Write a report that focuses only on the malware's capabilities and not on IOCs

Write two reports: one technical with IOCs and analysis details, and one executive summary with business impact and recommendations

Which of the following is typically included in a malware analysis report?

The malware author's personal information

Indicators of compromise (IOCs) such as file hashes and network signatures

The analyst's personal opinions

EC-CouncilComputer Hacking Forensic Investigator

Domain 4Objective 2

Malware Forensics CHFI Practice Questions (Page 10)

Part of the Network and Malware Forensics domain, which makes up ~15% of our current practice bank.

55questions here

11free pages

11concepts

Questions 46–50

46foundation · easy
Which of the following is an example of a persistence mechanism that malware might use?
Select an answer first
47application · medium
A forensic analyst has completed the analysis of a banking trojan and needs to write a report for the organization's security team. Which of the following is the most important to include in the report?
Select an answer first
48foundation · easy
Which of the following is a type of malware that is designed to encrypt a victim's files and demand payment for the decryption key?
Select an answer first
49expert · hard
A forensic analyst has completed a malware analysis and must write a report for both technical and executive audiences. Which of the following is the best approach?
Select an answer first
50foundation · easy
Which of the following is typically included in a malware analysis report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.