Dynamic Malware Analysis DFE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of dynamic malware analysis?

   • ATo decompile the malware into a readable programming language
   • BTo examine the malware's source code without executing it
   • CTo identify the malware's hash value and compare it to known signatures
   • DTo execute malware in a controlled environment and observe its runtime behavior
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During dynamic analysis, an analyst observes that the malware makes DNS queries to a domain that is not yet resolved. The analyst wants to determine if the malware is using a domain generation algorithm (DGA). Which observation would support this conclusion?

   • AThe malware makes a single DNS query to a known malicious domain.
   • BThe malware uses a static IP address for communication.
   • CThe malware sends a large amount of data to a legitimate website.
   • DThe malware makes many DNS queries to random-looking domains that do not exist.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which tool is commonly used to capture and analyze network traffic during dynamic malware analysis?

   • AWireshark
   • BRegshot
   • CProcess Monitor
   • DProcess Explorer
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is analyzing a sample that is suspected of attempting to escalate privileges. Which observation would most strongly indicate privilege escalation behavior?

   • AThe malware sends a DNS query to a domain.
   • BThe malware writes to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key.
   • CThe malware attempts to enable the SeDebugPrivilege token and injects code into a SYSTEM process.
   • DThe malware creates a mutex to prevent multiple instances.
   Reveal Solution Discussion Select an answer first
6. 5application · easy

   A security analyst is asked to determine whether a suspicious file is benign or malicious. The analyst decides to execute the file in a controlled environment and observe its behavior. Which statement best describes the purpose of this dynamic analysis?

   • ATo reverse engineer the file's code and understand its algorithms.
   • BTo compare the file's hash against known malware databases.
   • CTo observe the file's actual behavior, such as file modifications, network connections, and registry changes, in a safe environment.
   • DTo examine the file's static properties, such as strings and imports, without executing it.
   Reveal Solution Discussion Select an answer first