An analyst is investigating a machine that was infected with a worm. The worm is known to spread via network shares and also creates a service to maintain persistence. Which of the following is the most effective way to prevent the worm from re-infecting the machine after cleanup?

Only delete the malicious service and reboot the machine

Patch the vulnerability that the worm exploits and remove the malicious service

Disable the network share and delete the service

Disconnect the machine from the network permanently

A malware analyst is analyzing a sample that behaves normally in a sandbox but is known to be malicious in the wild. The analyst suspects the malware is evading the sandbox. The sample checks for the presence of a specific hardware device, the system's uptime, and the number of running processes. The analyst wants to confirm the evasion and still observe the malware's behavior. Which approach is most effective?

Use a debugger to patch out the evasion checks in the binary before executing it.

Modify the sandbox to emulate the expected hardware device, increase the system uptime, and add more running processes, then execute the sample again.

Run the sample in a different sandbox that does not have those hardware and process characteristics.

Analyze the sample only statically and ignore dynamic analysis.

What is the main objective of malware reverse engineering?

To identify the malware's author

To deobfuscate and reconstruct the malware's inner workings to identify its capabilities

To delete the malware from the infected system

To create a signature for antivirus detection

An incident responder found a suspicious executable in a user's startup folder. The analyst needs to determine whether the malware has other persistence mechanisms. Which of the following is the most reliable way to identify additional persistence locations?

Check the Windows Registry for Run keys and services

Search the file system for recently modified executables

Review the user's browser history for download URLs

Use Autoruns to enumerate all startup locations, including registry, services, scheduled tasks, and drivers

EC-CouncilComputer Hacking Forensic Investigator

Domain 4Objective 2

Malware Forensics CHFI Practice Questions (Page 2)

Part of the Network and Malware Forensics domain, which makes up ~15% of our current practice bank.

55questions here

11free pages

11concepts

Questions 6–10

6application · medium
An analyst is investigating a machine that was infected with a worm. The worm is known to spread via network shares and also creates a service to maintain persistence. Which of the following is the most effective way to prevent the worm from re-infecting the machine after cleanup?
Select an answer first
7foundation · easy
Which of the following tools is commonly used to capture and analyze network traffic during malware analysis?
Select an answer first
8expert · hard
A malware analyst is analyzing a sample that behaves normally in a sandbox but is known to be malicious in the wild. The analyst suspects the malware is evading the sandbox. The sample checks for the presence of a specific hardware device, the system's uptime, and the number of running processes. The analyst wants to confirm the evasion and still observe the malware's behavior. Which approach is most effective?
Select an answer first
9foundation · easy
What is the main objective of malware reverse engineering?
Select an answer first
10application · medium
An incident responder found a suspicious executable in a user's startup folder. The analyst needs to determine whether the malware has other persistence mechanisms. Which of the following is the most reliable way to identify additional persistence locations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Malware Forensics CHFI Practice Questions (Page 2)

Questions 6–10

An analyst is investigating a machine that was infected with a worm. The worm is known to spread via network shares and also creates a service to maintain persistence. Which of the following is the most effective way to prevent the worm from re-infecting the machine after cleanup?

Which of the following tools is commonly used to capture and analyze network traffic during malware analysis?

What is the main objective of malware reverse engineering?

An incident responder found a suspicious executable in a user's startup folder. The analyst needs to determine whether the malware has other persistence mechanisms. Which of the following is the most reliable way to identify additional persistence locations?

Keep studying — Network and Malware Forensics