Dynamic Malware Analysis DFE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is it important to take a snapshot of a virtual machine before executing malware?

   • ATo restore the system to a clean state after analysis
   • BTo increase the processing speed of the virtual machine
   • CTo automatically share the analysis results with other analysts
   • DTo allow the malware to access the host's file system
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An analyst has completed dynamic analysis of a multi-stage malware. The first stage downloads a second stage from a URL, and the second stage installs a driver. The analyst needs to write a report that will help the incident response team contain the malware. Which information is most critical to include?

   • AThe analyst's interpretation of the malware's purpose.
   • BThe time it took for the malware to execute.
   • CThe URL used for the second stage download and the driver file name and hash.
   • DThe total number of files created during the analysis.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After completing dynamic analysis of a banking trojan, an analyst must produce a report for the incident response team. The report should include indicators of compromise (IOCs) and behavioral observations. Which set of items should the analyst include?

   • AThe malware's source code and the developer's identity.
   • BThe analyst's personal notes and the malware's download URL.
   • CA list of all files on the system and the system's uptime.
   • DFile hashes, registry keys modified, network domains contacted, and process names created.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst is preparing a VM for dynamic analysis of a rootkit. The analyst wants to ensure that the VM can be restored to a clean state after the analysis. Which step is essential before executing the malware?

   • ATake a snapshot of the VM in a clean state.
   • BDisable the VM's virtual network adapter entirely.
   • CConnect the VM to the corporate network to download updates.
   • DInstall the latest antivirus definitions on the VM.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst is analyzing a sample that is suspected of using a rootkit to hide its processes. The analyst has Process Explorer and Process Monitor available. The analyst notices that the malware creates a process that is not visible in Process Explorer. Which action should the analyst take to confirm the hidden process?

   • AUse a kernel-mode tool or a separate system that can detect hidden processes, such as a rootkit detector.
   • BUse Process Monitor to log process creation events, which may reveal the hidden process.
   • CReboot the system and check the registry for persistence entries.
   • DUse TCPView to check for network connections from the hidden process.
   Reveal Solution Discussion Select an answer first