An organization has suffered a ransomware attack. The incident response team is considering whether to pay the ransom to recover data quickly. The forensic investigator advises against paying. Which reason is most aligned with forensic best practices?

Paying the ransom will erase all forensic evidence.

Paying the ransom may fund criminal activity and does not guarantee data recovery, and it may compromise the integrity of the investigation.

Paying the ransom will cause the malware to spread further.

Paying the ransom is illegal in all jurisdictions.

A company's IT team discovers that several employee workstations are infected with ransomware. The team wants to preserve evidence for a potential criminal investigation while minimizing further spread. Which action should the team take first?

Notify law enforcement before taking any action

Reboot the infected workstations to clear the ransomware from memory

Run an antivirus scan to remove the ransomware

Isolate the infected workstations from the network

A network administrator notices that a server is sending outbound connections to an unknown IP address on port 443. The server was recently patched, but a vulnerability in a web application was exploited. The administrator suspects the server is running cryptocurrency mining malware. Which infection vector is most likely responsible?

Removable media plugged into the server

Email attachment opened by an administrator

Network exploit of the vulnerable web application

Malicious website visited by a user

A malware analyst is examining a suspicious file that, when executed, creates a copy of itself in the system directory and modifies the boot configuration to load the copy at startup. The file also scans the network for other vulnerable systems and attempts to copy itself to them. Which classification best describes this malware?

Worm with persistence mechanisms

Trojan with spyware capabilities

Virus with backdoor capabilities

Ransomware with worm capabilities

EC-CouncilDigital Forensics Essentials

Domain 7Objective 2

Malware Forensics Fundamentals DFE Practice Questions (Page 7)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

45questions here

9free pages

6concepts

Questions 31–35

31expert · hard
An organization has suffered a ransomware attack. The incident response team is considering whether to pay the ransom to recover data quickly. The forensic investigator advises against paying. Which reason is most aligned with forensic best practices?
Select an answer first
32application · medium
A company's IT team discovers that several employee workstations are infected with ransomware. The team wants to preserve evidence for a potential criminal investigation while minimizing further spread. Which action should the team take first?
Select an answer first
33foundation · easy
A user downloads a free game that secretly installs software to capture keystrokes and send them to a remote server. Which malware category best describes this software?
Select an answer first
34application · medium
A network administrator notices that a server is sending outbound connections to an unknown IP address on port 443. The server was recently patched, but a vulnerability in a web application was exploited. The administrator suspects the server is running cryptocurrency mining malware. Which infection vector is most likely responsible?
Select an answer first
35expert · hard
A malware analyst is examining a suspicious file that, when executed, creates a copy of itself in the system directory and modifies the boot configuration to load the copy at startup. The file also scans the network for other vulnerable systems and attempts to copy itself to them. Which classification best describes this malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Malware Forensics Fundamentals DFE Practice Questions (Page 7)

Questions 31–35

An organization has suffered a ransomware attack. The incident response team is considering whether to pay the ransom to recover data quickly. The forensic investigator advises against paying. Which reason is most aligned with forensic best practices?

A company's IT team discovers that several employee workstations are infected with ransomware. The team wants to preserve evidence for a potential criminal investigation while minimizing further spread. Which action should the team take first?

A user downloads a free game that secretly installs software to capture keystrokes and send them to a remote server. Which malware category best describes this software?

Keep studying — Malware Forensics