An incident responder is analyzing a system infected with malware that hides its processes by using a rootkit technique. The malware also modifies system files to avoid detection. Which two behaviors are being exhibited?

Defense evasion and persistence

Process injection and privilege escalation

Network communication and data exfiltration

Which activity is a core component of malware forensics?

Performing static analysis of a malicious binary to identify its code structure and embedded strings

Deleting malware from an infected system to restore normal operations

Configuring a firewall to block outbound connections from a compromised host

Encrypting a suspect's hard drive to protect the evidence from tampering

A forensic analyst is examining a Windows workstation that was infected after a user clicked a link in a phishing email. The analyst observes that the malware creates a scheduled task that runs a PowerShell script every time the user logs on, and the script periodically sends HTTP POST requests to a remote server. Which malware behavior is the analyst most directly observing?

Data exfiltration and file encryption

Process injection and code obfuscation

Persistence mechanism and network communication

Privilege escalation and lateral movement

A security analyst notices that a workstation is making repeated outbound connections to an IP address known to be a command-and-control server. The malware was likely delivered via a malicious email attachment. Which two indicators support this infection vector?

The workstation's browser history shows visits to a malicious website.

The firewall logs show inbound connections from the C2 server to the workstation.

The email gateway logs show a suspicious attachment delivered to the user's mailbox, and the workstation's process list shows a process spawned from the attachment's filename.

The USB device history shows a recently connected removable drive.

During a malware investigation, an analyst observes that a suspicious process injects code into a legitimate system process (e.g., svchost.exe) and then creates a scheduled task to run a script at system startup. Which two behaviors are being exhibited?

Network communication and data exfiltration

Privilege escalation and defense evasion

File encryption and ransomware deployment

Process injection and persistence mechanism

EC-CouncilDigital Forensics Essentials

Domain 7Objective 2

Malware Forensics Fundamentals DFE Practice Questions (Page 1)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

45questions here

9free pages

6concepts

Questions 1–5

1application · medium
An incident responder is analyzing a system infected with malware that hides its processes by using a rootkit technique. The malware also modifies system files to avoid detection. Which two behaviors are being exhibited?
Select an answer first
2foundation · easy
Which activity is a core component of malware forensics?
Select an answer first
3application · medium
A forensic analyst is examining a Windows workstation that was infected after a user clicked a link in a phishing email. The analyst observes that the malware creates a scheduled task that runs a PowerShell script every time the user logs on, and the script periodically sends HTTP POST requests to a remote server. Which malware behavior is the analyst most directly observing?
Select an answer first
4application · medium
A security analyst notices that a workstation is making repeated outbound connections to an IP address known to be a command-and-control server. The malware was likely delivered via a malicious email attachment. Which two indicators support this infection vector?
Select an answer first
5application · medium
During a malware investigation, an analyst observes that a suspicious process injects code into a legitimate system process (e.g., svchost.exe) and then creates a scheduled task to run a script at system startup. Which two behaviors are being exhibited?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.