Dynamic Malware Analysis DFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An analyst is analyzing a sample that is suspected of using DNS tunneling for data exfiltration. The analyst has captured network traffic with Wireshark. Which observation would most strongly indicate DNS tunneling?

   • AAn HTTP POST request to a web server on port 80.
   • BA TCP connection to a remote server on port 443.
   • CA large volume of DNS queries to a single domain, with long subdomain labels containing encoded data.
   • DA single DNS query to a well-known domain like google.com.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An analyst needs to observe the behavior of a suspicious executable in a controlled environment. The analyst has a dedicated analysis laptop with a wired NIC and a wireless NIC. The malware is known to attempt outbound connections. Which network configuration should the analyst use to safely execute the malware while still allowing observation of its network activity?

   • AUse the wireless NIC in the VM with NAT mode to allow internet access for the malware.
   • BConnect the laptop to the corporate network and use a virtual machine with a bridged adapter.
   • CDisable both NICs and use a virtual machine with a host-only network adapter.
   • DDisable the wired NIC and enable the wireless NIC for the VM in bridged mode.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   After completing dynamic analysis of a banking trojan, an analyst must produce a report for the incident response team. Which element is most important to include in the report to help the team detect the malware in their environment?

   • AIndicators of compromise (IOCs) such as file hashes, registry keys, and C2 domains
   • BThe analyst's personal opinion on the malware's sophistication
   • CThe name of the antivirus product used on the analysis VM
   • DThe exact number of packets captured during analysis
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An analyst is analyzing a sample that appears to detect that it is running in a virtual machine and changes its behavior accordingly. Which anti-analysis technique is the malware most likely using?

   • APrivilege escalation
   • BNetwork beaconing
   • CSandbox evasion
   • DPersistence mechanism
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An analyst is setting up a malware analysis lab. The lab will be used to analyze samples that communicate with external servers. The analyst wants to allow the malware to think it has internet access while actually redirecting all traffic to a controlled environment. Which network configuration should the analyst use?

   • AA bridged network with a real public IP address.
   • BA host-only network with a fake DNS server and a proxy that logs all requests.
   • CAn isolated network with no DNS server configured.
   • DA NAT network with no firewall rules.
   Reveal Solution Discussion Select an answer first