Malware Forensics Fundamentals DFE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company's security team is investigating a malware infection that originated from a USB drive found in the parking lot. The malware is a trojan that establishes a reverse shell to an external server. The team needs to determine the full scope of the infection. Which combination of actions should the team take?

   • AReimage all systems immediately and ignore the USB drive
   • BIsolate affected systems, analyze the USB drive's contents, and review network logs for connections to the external server
   • CDisconnect the external server from the internet and continue normal operations
   • DRun an antivirus scan on the USB drive and delete the malware
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is a key privacy concern when conducting malware forensics on a corporate-owned computer?

   • AThe forensic examination may inadvertently access personal data belonging to the employee
   • BThe forensic tools used may be too expensive for the organization
   • CThe investigation may slow down the employee's computer
   • DThe malware may be protected by copyright law, preventing analysis
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company has experienced a malware outbreak. The incident response team has contained the infection and collected forensic images of affected systems. The team now needs to determine the root cause and the extent of the infection. Which phase of the malware forensics investigation process does this represent?

   • AAnalysis
   • BContainment
   • CIdentification
   • DReporting
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A malware analyst is examining a sample that uses a technique to hide its malicious code by encrypting its payload and decrypting it only in memory at runtime. The analyst wants to identify the decrypted payload for further analysis. Which approach is most effective?

   • APerform static analysis on the encrypted payload
   • BUse a hex editor to search for the decrypted payload in the file
   • CSubmit the sample to an online scanner and rely on its report
   • DRun the sample in a debugger and dump the decrypted memory region after the decryption routine executes
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A forensic investigator is called to examine a laptop that may contain malware. The laptop belongs to an employee who is suspected of downloading malware intentionally. The investigator needs to collect evidence that will be admissible in court. Which practice is essential to maintain the integrity of the evidence?

   • ADocumenting every action taken with the device and preserving the original storage media
   • BBooting the laptop to a live Linux USB to avoid altering the hard drive
   • CRunning a full antivirus scan to confirm the malware is present
   • DCopying the hard drive using a standard file copy command
   Reveal Solution Discussion Select an answer first