Forensic Investigation and Malware Analysis CSA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC analyst is setting up a dynamic malware analysis environment. The malware is known to detect virtual machines and refuse to run. Which configuration is most likely to help the malware execute successfully?

   • AUse a standard VMware virtual machine with default settings and internet access.
   • BUse a real physical machine with no network connectivity and restore it from a clean image after analysis.
   • CRun the malware on the analyst's main workstation with a debugger attached.
   • DUse a cloud-based VM with public IP and no snapshots.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During static analysis of a malware sample, the analyst notices that the file's import table only contains LoadLibrary and GetProcAddress. The file size is unusually large for the number of imports. What is the most likely explanation?

   • AThe file is a legitimate program that uses only those two APIs.
   • BThe malware is packed or obfuscated, and it resolves additional APIs dynamically at runtime.
   • CThe file is a script disguised as an executable.
   • DThe file is corrupted and cannot be analyzed.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   When collecting digital evidence from a live system, which type of data should be collected FIRST to avoid losing it?

   • AVolatile data such as running processes and network connections
   • BMetadata of files such as timestamps
   • CLogs from the operating system
   • DNon-volatile data such as files on the hard drive
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a key advantage of dynamic malware analysis over static analysis?

   • AIt does not risk infecting the analyst's system
   • BIt can analyze packed malware without unpacking
   • CIt is faster and requires no special environment
   • DIt reveals the actual behavior of the malware when executed
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   During dynamic analysis of a malware sample, the analyst observes that the sample makes DNS queries to a domain that changes every few minutes. The analyst suspects the malware uses domain generation algorithms (DGAs). Which approach is most effective for identifying the C2 infrastructure?

   • ASearch the malware's binary for hardcoded domain names.
   • BUse a packet sniffer to capture the malware's network traffic and look for the C2 IP address directly.
   • CBlock all DNS queries from the sandbox to prevent the malware from communicating.
   • DMonitor DNS queries over time and correlate them with the malware's execution to identify patterns and predict future domains.
   Reveal Solution Discussion Select an answer first