A security analyst is investigating a malware infection that appears to have originated from a malicious website. The malware is a trojan that downloads additional payloads from a C2 server. Which two pieces of evidence would most strongly support the malicious website as the infection vector?

USB device history showing a recently connected drive.

Firewall logs showing inbound connections from the C2 server.

Browser history showing visits to the malicious site and network logs showing a connection from the browser to the site at the time of infection.

Email logs showing a phishing email with a link to the malicious site.

A malware analyst is investigating a suspicious executable found on a compromised workstation. The analyst needs to determine what the executable does without risking further infection of the analysis environment. Which approach should the analyst use?

Disassemble the executable using a debugger on the analyst's primary workstation

Run the executable in a sandboxed virtual machine with network monitoring

Submit the executable to an online malware scanning service

Execute the executable directly on the compromised workstation to observe its behavior

A forensic analyst is documenting a malware investigation for a court case. The analyst must ensure that the evidence is admissible. Which practice is most important?

Keep the evidence in the analyst's personal locker to ensure security.

Maintain a detailed chain of custody log that records every person who handled the evidence and when.

Avoid making any notes until the investigation is complete.

Use only commercial forensic tools to analyze the evidence.

A forensic analyst is examining a memory dump from a compromised server. The analyst finds that a malicious DLL has been loaded into the address space of a legitimate service process. The DLL is not listed in the service's normal module list. Which malware behavior is this evidence of?

Persistence via registry run key

EC-CouncilDigital Forensics Essentials

Domain 7Objective 2

Malware Forensics Fundamentals DFE Practice Questions (Page 5)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

45questions here

9free pages

6concepts

Questions 21–25

21expert · hard
A security analyst is investigating a malware infection that appears to have originated from a malicious website. The malware is a trojan that downloads additional payloads from a C2 server. Which two pieces of evidence would most strongly support the malicious website as the infection vector?
Select an answer first
22application · medium
A malware analyst is investigating a suspicious executable found on a compromised workstation. The analyst needs to determine what the executable does without risking further infection of the analysis environment. Which approach should the analyst use?
Select an answer first
23foundation · easy
Which step in a malware forensics investigation involves isolating the infected system from the network to prevent the malware from spreading?
Select an answer first
24application · medium
A forensic analyst is documenting a malware investigation for a court case. The analyst must ensure that the evidence is admissible. Which practice is most important?
Select an answer first
25application · medium
A forensic analyst is examining a memory dump from a compromised server. The analyst finds that a malicious DLL has been loaded into the address space of a legitimate service process. The DLL is not listed in the service's normal module list. Which malware behavior is this evidence of?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.