During a forensic investigation, an analyst discovers that a malicious executable has been persisting across reboots. The analyst wants to identify the persistence mechanism without executing the malware again. Which action is most effective?

Capture network traffic to see if the malware connects to a command-and-control server.

Examine the registry Run keys, scheduled tasks, and startup folders for references to the executable.

Run the executable in a sandbox and monitor which files it creates.

Use a debugger to trace the executable's entry point and identify its main function.

A forensic investigator is analyzing a suspicious document that contains an embedded macro. The investigator wants to extract the macro code without opening the document in a word processor. Which tool or technique is most appropriate?

Use a packet analyzer to capture network traffic while the document is opened.

Use a hex editor to manually search for the macro code in the document's raw bytes.

Open the document in a word processor with macros disabled and view the macro code.

Use a tool like olevba or a similar macro extraction utility to extract and analyze the macro code.

Which of the following is a common persistence mechanism used by malware on Windows systems?

Deleting the system restore points

Adding an entry to the Windows Registry Run key

Which of the following activities would be observed during dynamic analysis of malware in a sandbox?

Identifying the compiler used to build the malware

Reading the malware's import table

Monitoring registry key changes made by the malware

Extracting strings from the malware binary

EC-CouncilComputer Hacking Forensic Investigator

Domain 4Objective 2

Malware Forensics CHFI Practice Questions (Page 4)

Part of the Network and Malware Forensics domain, which makes up ~15% of our current practice bank.

55questions here

11free pages

11concepts

Questions 16–20

16application · medium
During a forensic investigation, an analyst discovers that a malicious executable has been persisting across reboots. The analyst wants to identify the persistence mechanism without executing the malware again. Which action is most effective?
Select an answer first
17application · medium
A forensic investigator is analyzing a suspicious document that contains an embedded macro. The investigator wants to extract the macro code without opening the document in a word processor. Which tool or technique is most appropriate?
Select an answer first
18application · medium
During a malware investigation, an analyst needs to preserve a memory dump from a compromised Windows system for later analysis. Which tool is most appropriate for this task?
Select an answer first
19foundation · easy
Which of the following is a common persistence mechanism used by malware on Windows systems?
Select an answer first
20foundation · easy
Which of the following activities would be observed during dynamic analysis of malware in a sandbox?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.