An analyst is analyzing a piece of malware that is known to delete its own executable from disk after running. The analyst wants to capture the file system activity to document the deletion and any other files created. The analyst has Process Monitor and Regshot available. Which approach will provide the most complete documentation?

Run Process Monitor with file system and registry monitoring enabled, and take a Regshot snapshot before and after execution.

Take a snapshot of the VM before execution and compare the file system after execution using the VM snapshot feature.

Use only Process Monitor to log file system activity, and manually note the deletion.

Use only Regshot to compare file system snapshots before and after execution.

An organization is considering whether to use dynamic analysis to investigate a suspected zero-day exploit. Which advantage does dynamic analysis offer over static analysis in this scenario?

It can reveal the actual runtime behavior, such as which processes are spawned and what network connections are made.

It does not require any specialized tools or skills.

It is faster than static analysis because it does not require a controlled environment.

It can identify all code paths without executing the malware.

An analyst is using Process Monitor to analyze a sample that is suspected of process hollowing. The analyst sees that the malware creates a process in a suspended state, then writes to the process's memory, and then resumes the process. Which Process Monitor event sequence would confirm this behavior?

Process Create followed by immediate termination of the process.

Network connections followed by process termination.

Registry modifications followed by file writes.

Process Create with suspend flag, followed by WriteProcessMemory calls, followed by ResumeThread.

An analyst is executing a sample that is suspected of beaconing to a command-and-control server. The analyst has a host-only network between the VM and the host. Which tool should the analyst use to capture the outbound connection attempts from the VM?

Wireshark on the host's virtual adapter

EC-CouncilDigital Forensics Essentials

Domain 7Objective 4

Dynamic Malware Analysis DFE Practice Questions (Page 3)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

45questions here

9free pages

6concepts

Questions 11–15

11expert · hard
An analyst is analyzing a piece of malware that is known to delete its own executable from disk after running. The analyst wants to capture the file system activity to document the deletion and any other files created. The analyst has Process Monitor and Regshot available. Which approach will provide the most complete documentation?
Select an answer first
12application · medium
An organization is considering whether to use dynamic analysis to investigate a suspected zero-day exploit. Which advantage does dynamic analysis offer over static analysis in this scenario?
Select an answer first
13application · medium
During dynamic analysis of a trojan, an analyst wants to identify which registry keys are created or modified when the malware runs. The analyst has already taken a snapshot of the clean VM. Which tool should the analyst use to capture registry changes before and after execution?
Select an answer first
14expert · hard
An analyst is using Process Monitor to analyze a sample that is suspected of process hollowing. The analyst sees that the malware creates a process in a suspended state, then writes to the process's memory, and then resumes the process. Which Process Monitor event sequence would confirm this behavior?
Select an answer first
15application · medium
An analyst is executing a sample that is suspected of beaconing to a command-and-control server. The analyst has a host-only network between the VM and the host. Which tool should the analyst use to capture the outbound connection attempts from the VM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Dynamic Malware Analysis DFE Practice Questions (Page 3)

Questions 11–15

An organization is considering whether to use dynamic analysis to investigate a suspected zero-day exploit. Which advantage does dynamic analysis offer over static analysis in this scenario?

During dynamic analysis of a trojan, an analyst wants to identify which registry keys are created or modified when the malware runs. The analyst has already taken a snapshot of the clean VM. Which tool should the analyst use to capture registry changes before and after execution?

An analyst is executing a sample that is suspected of beaconing to a command-and-control server. The analyst has a host-only network between the VM and the host. Which tool should the analyst use to capture the outbound connection attempts from the VM?

Keep studying — Malware Forensics