During static malware analysis, which of the following actions is performed?

Debugging the malware to trace its execution flow

Examining the file's strings, headers, and embedded indicators without running it

Executing the malware in a virtual machine to observe its behavior

Monitoring network traffic generated by the malware

A forensic analyst is investigating a system infected with malware that persists across reboots. The analyst has checked the standard registry Run keys, scheduled tasks, and startup folders, but found nothing. The malware is still executing after reboot. Which persistence mechanism should the analyst investigate next?

Check the malware's import table for the CreateService API to confirm it creates a service.

Check the Windows event logs for evidence of the malware's execution.

Run the malware in a sandbox and observe which files it creates.

Check for a Windows service that is configured to start automatically and points to the malware executable.

Which of the following is an example of a malware artifact that should be extracted and preserved?

A memory dump of the infected process

In the context of malware forensics, what is the primary goal of the analysis process?

To delete the malware from the infected system immediately

To recover deleted files from the infected system

To identify the malware author and prosecute them

To determine how the malware works, what it does, and how to detect and mitigate it

What is the primary purpose of a malware analysis report?

To document findings, including IOCs, behavior, and mitigation strategies

To replace the need for further analysis

To provide a legal basis for prosecuting the malware author

To sell the analysis to other organizations

EC-CouncilComputer Hacking Forensic Investigator

Domain 4Objective 2

Malware Forensics CHFI Practice Questions (Page 8)

Part of the Network and Malware Forensics domain, which makes up ~15% of our current practice bank.

55questions here

11free pages

11concepts

Questions 36–40

36foundation · easy
During static malware analysis, which of the following actions is performed?
Select an answer first
37expert · hard
A forensic analyst is investigating a system infected with malware that persists across reboots. The analyst has checked the standard registry Run keys, scheduled tasks, and startup folders, but found nothing. The malware is still executing after reboot. Which persistence mechanism should the analyst investigate next?
Select an answer first
38foundation · easy
Which of the following is an example of a malware artifact that should be extracted and preserved?
Select an answer first
39foundation · easy
In the context of malware forensics, what is the primary goal of the analysis process?
Select an answer first
40foundation · easy
What is the primary purpose of a malware analysis report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.