Malware Forensics Fundamentals DFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is reviewing a malware sample that was delivered via a malicious USB drive. The sample copies itself to multiple folders on the local disk and modifies the Windows Registry to run at startup. It does not attempt to spread to other computers over the network. Which classification best describes this malware?

   • ATrojan
   • BWorm
   • CRansomware
   • DVirus
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Malware that injects its code into a legitimate running process to hide its malicious activity is exhibiting which behavior?

   • ANetwork communication
   • BFile encryption
   • CPersistence mechanism
   • DProcess injection
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why is maintaining a proper chain of custody critical in malware forensics?

   • ATo speed up the analysis process by allowing multiple analysts to work on the same evidence simultaneously
   • BTo ensure the evidence is admissible in court by documenting its handling and integrity
   • CTo protect the malware from being accidentally deleted by antivirus software
   • DTo encrypt the evidence so that only authorized personnel can access it
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which type of malware is characterized by self-replication and the ability to spread to other computers without requiring a host file?

   • AVirus
   • BTrojan
   • CWorm
   • DRansomware
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which behavior is commonly used by malware to maintain its presence on an infected system across reboots?

   • ASending spam emails to other users
   • BCreating a registry entry to run automatically at startup
   • CDeleting all system logs to hide its activities
   • DEncrypting its own code to avoid detection
   Reveal Solution Discussion Select an answer first