Malware Forensics CHFI Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An incident responder is analyzing a memory dump from a compromised server. The responder suspects that the malware injected code into a legitimate process. Which technique is most effective for identifying the injected code?

   • ASearch the memory dump for strings that match known malware indicators.
   • BCompare the memory dump to a clean baseline of the same system to identify differences.
   • CRun the memory dump through an antivirus scanner.
   • DUse a memory forensics tool to list the virtual address descriptors (VADs) and look for private, executable, non-backed memory regions.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A malware analyst is about to execute a suspicious binary in a controlled lab. The analyst needs to observe file system changes, registry modifications, and network connections made by the sample. Which setup best satisfies these requirements?

   • AA physical machine with a clean OS image and a network tap
   • BA virtual machine with a snapshot, process monitor, and a network analyzer on the host
   • CA sandbox that only logs network traffic
   • DA container with a read-only file system and no network access
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of dynamic malware analysis?

   • ATo identify the malware's author through code signatures
   • BTo execute the malware in a controlled environment and observe its behavior
   • CTo examine the malware's code without executing it
   • DTo reverse engineer the malware's encryption algorithms
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A malware analyst is examining a network capture from a sandbox. The malware is making DNS queries to a domain that changes frequently. What is the most likely purpose of this behavior?

   • ATo use fast-flux DNS to hide the C2 server behind a rotating set of IP addresses
   • BTo resolve the domain to a different IP to avoid network-based detection
   • CTo test network connectivity before establishing a C2 channel
   • DTo perform DNS-based data exfiltration by encoding data in subdomains
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An analyst is investigating a malware sample that uses domain generation algorithms (DGAs) to communicate with its command-and-control server. The analyst has captured network traffic from a sandbox execution, but the malware only made a few DNS queries and did not establish a connection. The analyst needs to identify the C2 domain for blocking. Which technique is most effective?

   • ASearch online threat intelligence feeds for the malware's hash to find known C2 domains.
   • BUse a network analyzer to decrypt the DNS traffic and extract the domain from the queries.
   • CReverse engineer the DGA algorithm and generate the list of domains for the current date, then check which one the malware attempted to resolve.
   • DRun the malware in a sandbox for a longer period to see if it eventually connects to a C2 server.
   Reveal Solution Discussion Select an answer first