A company has experienced a malware outbreak. The malware is spreading rapidly across the network, and the security team suspects it entered via a phishing email. However, the email gateway logs are inconclusive. The team must contain the outbreak while preserving evidence for a forensic investigation. Which approach best balances containment and evidence preservation?

Power off all affected systems immediately to stop the malware.

Disconnect the entire network from the internet and continue normal operations internally.

Isolate affected systems from the network, capture memory images, and then perform disk imaging on a sample of systems.

Run antivirus scans on all systems and quarantine detected malware.

A forensic analyst is investigating a malware infection on a company laptop that contains personal employee data. The analyst needs to collect evidence while respecting privacy regulations. Which action is most appropriate?

Proceed without documenting anything to avoid creating a paper trail.

Copy the entire hard drive including personal files to ensure no evidence is missed.

Ask the employee for consent to access all personal files.

Limit the collection to files and data relevant to the malware investigation and document the legal authority for the search.

An analyst is reviewing a malware sample that spreads across the network by exploiting a vulnerability in a file-sharing service, without requiring user interaction. Once inside, it installs a keylogger to capture credentials. How should this malware be classified?

Trojan with ransomware capabilities

Ransomware with worm capabilities

Virus with backdoor capabilities

A forensic investigator is handling a case where malware was found on an employee's personal laptop that was used for work purposes. The company's policy allows forensic examination of personal devices if there is a reasonable suspicion of wrongdoing. The investigator needs to collect evidence while respecting privacy concerns. Which action is most appropriate?

Only examine files related to work and ignore personal data

Obtain written consent from the employee or a legal warrant before imaging the device

Ask the employee to provide the device password and then image it

Image the device immediately without consent to preserve evidence

EC-CouncilDigital Forensics Essentials

Domain 7Objective 2

Malware Forensics Fundamentals DFE Practice Questions (Page 2)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

45questions here

9free pages

6concepts

Questions 6–10

6expert · hard
A company has experienced a malware outbreak. The malware is spreading rapidly across the network, and the security team suspects it entered via a phishing email. However, the email gateway logs are inconclusive. The team must contain the outbreak while preserving evidence for a forensic investigation. Which approach best balances containment and evidence preservation?
Select an answer first
7application · medium
A forensic analyst is investigating a malware infection on a company laptop that contains personal employee data. The analyst needs to collect evidence while respecting privacy regulations. Which action is most appropriate?
Select an answer first
8application · medium
An analyst is reviewing a malware sample that spreads across the network by exploiting a vulnerability in a file-sharing service, without requiring user interaction. Once inside, it installs a keylogger to capture credentials. How should this malware be classified?
Select an answer first
9foundation · easy
An attacker exploits a vulnerability in a network service to deliver malware directly to a computer without any user interaction. Which infection vector does this describe?
Select an answer first
10expert · hard
A forensic investigator is handling a case where malware was found on an employee's personal laptop that was used for work purposes. The company's policy allows forensic examination of personal devices if there is a reasonable suspicion of wrongdoing. The investigator needs to collect evidence while respecting privacy concerns. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Malware Forensics Fundamentals DFE Practice Questions (Page 2)

Questions 6–10

A forensic analyst is investigating a malware infection on a company laptop that contains personal employee data. The analyst needs to collect evidence while respecting privacy regulations. Which action is most appropriate?

An analyst is reviewing a malware sample that spreads across the network by exploiting a vulnerability in a file-sharing service, without requiring user interaction. Once inside, it installs a keylogger to capture credentials. How should this malware be classified?

An attacker exploits a vulnerability in a network service to deliver malware directly to a computer without any user interaction. Which infection vector does this describe?

Keep studying — Malware Forensics