What is the primary purpose of malware forensics within the digital forensics process?

To monitor network traffic in real time to block malicious packets

To recover deleted files from a suspect's hard drive for evidence in a criminal case

To prevent malware from infecting a system by installing antivirus software

To identify, analyze, and understand malicious software to support incident response and legal proceedings

A forensic team is investigating a malware infection on a critical production server. The server cannot be taken offline for more than 30 minutes due to business requirements. The team needs to preserve volatile evidence (e.g., memory, running processes) and then perform a forensic analysis. Which approach best balances the need for evidence preservation with the operational constraint?

Copy the hard drive using a standard file copy while the server is running

Perform a live analysis on the server without taking it offline

Immediately shut down the server to preserve the disk state

Acquire a memory dump and capture running process information, then take the server offline for disk imaging

A forensic investigator is handling a malware case that involves a cloud-hosted server. The server is located in a different jurisdiction than the investigator's office. The investigator needs to collect evidence while complying with legal and privacy regulations. Which action is most appropriate?

Coordinate with the cloud provider and local legal counsel to ensure proper legal authority and data handling procedures.

Directly access the server using the administrator credentials provided by the company.

Ask the cloud provider to delete the server to prevent further damage.

Copy all data from the server to a local drive without notifying the provider.

A malware analyst is tasked with determining whether a suspicious file is malicious. The analyst has limited time and needs a quick initial assessment. Which approach provides the fastest and least resource-intensive method to get an initial indication?

Submit the file to an automated online sandbox service

Perform static analysis by examining the file's strings, imports, and metadata

Disassemble the entire binary using a debugger

Run the file in a full sandbox environment with network simulation

A company has identified a malware infection on a server. The incident response team needs to contain the infection while preserving evidence for a forensic investigation. Which action should be taken FIRST?

Power off the server immediately to stop the malware.

Isolate the server from the network by disconnecting the network cable or disabling the virtual NIC.

Run a full antivirus scan and delete any detected malware.

Notify law enforcement before taking any action.

EC-CouncilDigital Forensics Essentials

Domain 7Objective 2

Malware Forensics Fundamentals DFE Practice Questions (Page 9)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

45questions here

9free pages

6concepts

Questions 41–45

41foundation · easy
What is the primary purpose of malware forensics within the digital forensics process?
Select an answer first
42expert · hard
A forensic team is investigating a malware infection on a critical production server. The server cannot be taken offline for more than 30 minutes due to business requirements. The team needs to preserve volatile evidence (e.g., memory, running processes) and then perform a forensic analysis. Which approach best balances the need for evidence preservation with the operational constraint?
Select an answer first
43expert · hard
A forensic investigator is handling a malware case that involves a cloud-hosted server. The server is located in a different jurisdiction than the investigator's office. The investigator needs to collect evidence while complying with legal and privacy regulations. Which action is most appropriate?
Select an answer first
44application · medium
A malware analyst is tasked with determining whether a suspicious file is malicious. The analyst has limited time and needs a quick initial assessment. Which approach provides the fastest and least resource-intensive method to get an initial indication?
Select an answer first
45application · medium
A company has identified a malware infection on a server. The incident response team needs to contain the infection while preserving evidence for a forensic investigation. Which action should be taken FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.