During dynamic analysis, an analyst captures network traffic and sees that the malware is communicating with an IP address on port 443 using TLS. The analyst wants to determine the content of the communication. Which approach is most appropriate?

Block port 443 and rerun the malware to see if it uses another port.

Ignore the TLS traffic because it is encrypted and cannot be analyzed.

Use a man-in-the-middle proxy with a custom certificate installed on the VM to decrypt TLS traffic.

Use Wireshark to decrypt the TLS traffic without any additional configuration.

What is an indicator of compromise (IoC) in a malware analysis report?

A piece of forensic evidence that suggests a system has been compromised

A summary of the analyst's personal opinions about the malware

The name of the antivirus product used to scan the system

What type of information can TCPView provide during dynamic malware analysis?

A list of active TCP/UDP endpoints and the processes that own them

The malware's registry modifications

A history of all files opened by the malware

The contents of network packets in hexadecimal format

While analyzing a ransomware sample in a sandbox, an analyst notices that the malware checks for the presence of a debugger and then delays its execution if one is detected. The analyst also observes that the malware writes to the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Which two behaviors should the analyst document in the report?

Anti-debugging technique and persistence mechanism.

Network beaconing and file encryption.

Process injection and code obfuscation.

Privilege escalation and data exfiltration.

Which of the following is an example of a persistence mechanism that malware might use?

Using a packer to obfuscate its code

Creating a registry run key to launch the malware at system startup

Deleting its own executable after execution

EC-CouncilDigital Forensics Essentials

Domain 7Objective 4

Dynamic Malware Analysis DFE Practice Questions (Page 5)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

45questions here

9free pages

6concepts

Questions 21–25

21application · medium
During dynamic analysis, an analyst captures network traffic and sees that the malware is communicating with an IP address on port 443 using TLS. The analyst wants to determine the content of the communication. Which approach is most appropriate?
Select an answer first
22foundation · easy
What is an indicator of compromise (IoC) in a malware analysis report?
Select an answer first
23foundation · easy
What type of information can TCPView provide during dynamic malware analysis?
Select an answer first
24application · medium
While analyzing a ransomware sample in a sandbox, an analyst notices that the malware checks for the presence of a debugger and then delays its execution if one is detected. The analyst also observes that the malware writes to the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Which two behaviors should the analyst document in the report?
Select an answer first
25foundation · easy
Which of the following is an example of a persistence mechanism that malware might use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.