An analyst is investigating a rootkit that hides its processes and files. The analyst needs to extract the rootkit's artifacts from a live system. Which approach is most likely to succeed?

Boot from a forensic live CD and copy the entire hard drive

Perform a memory dump and analyze it with Volatility to find hidden processes and kernel modules

Run a rootkit scanner from the vendor's website

Use standard file explorer and Task Manager to locate the files and processes

What is the purpose of anti-debugging techniques used by malware?

To encrypt the malware's network traffic

To prevent the malware from being analyzed by debuggers

To hide the malware from the file system

While analyzing network traffic from a malware sandbox, an analyst observes periodic HTTPS connections to a domain that has a low reputation. The payload is encrypted. What is the most appropriate next step to determine if this is command-and-control (C2) traffic?

Decrypt the TLS traffic by installing a proxy certificate in the sandbox and re-running the sample

Block the domain at the firewall and assume the malware is neutralized

Check the DNS query history for the domain and correlate with the malware's execution time

Ignore the traffic because HTTPS is legitimate and cannot be malware

During reverse engineering of a malware sample, an analyst notices that the binary contains several opaque predicates and uses a junk-code insertion technique. What is the primary purpose of these obfuscation techniques?

To bypass antivirus signature detection by changing the file hash

To increase the file size and slow down the malware's execution

To encrypt the malware's network traffic

To make static analysis more difficult by adding code that never executes or has no effect

What is the primary purpose of analyzing network traffic generated by malware?

To determine the malware's file hash

To recover deleted files from the infected system

To identify the programming language used to write the malware

To identify the malware's command-and-control (C2) channels and data exfiltration

EC-CouncilComputer Hacking Forensic Investigator

Domain 4Objective 2

Malware Forensics CHFI Practice Questions (Page 7)

Part of the Network and Malware Forensics domain, which makes up ~15% of our current practice bank.

55questions here

11free pages

11concepts

Questions 31–35

31expert · hard
An analyst is investigating a rootkit that hides its processes and files. The analyst needs to extract the rootkit's artifacts from a live system. Which approach is most likely to succeed?
Select an answer first
32foundation · easy
What is the purpose of anti-debugging techniques used by malware?
Select an answer first
33application · medium
While analyzing network traffic from a malware sandbox, an analyst observes periodic HTTPS connections to a domain that has a low reputation. The payload is encrypted. What is the most appropriate next step to determine if this is command-and-control (C2) traffic?
Select an answer first
34application · medium
During reverse engineering of a malware sample, an analyst notices that the binary contains several opaque predicates and uses a junk-code insertion technique. What is the primary purpose of these obfuscation techniques?
Select an answer first
35foundation · easy
What is the primary purpose of analyzing network traffic generated by malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.