A user reports that their computer is running slowly and displaying pop-up advertisements even when no browser is open. The user recently installed a free media player from a third-party website. Which malware type and distribution vector are most likely involved?

Ransomware delivered via a malicious email

Worm spreading through network shares

Adware bundled with a free application

A forensic examiner is analyzing a system where the user clicked a link in a chat message that led to a website. The website exploited a browser vulnerability to install malware that encrypts the user's files and displays a ransom note. Which malware type and distribution vector are involved?

Trojan; social engineering via phone

A company is investigating a malware outbreak. The malware was distributed via a malicious email attachment that contained a macro. When the macro ran, it downloaded a payload that spread to other systems via network shares. Which distribution vector and propagation mechanism are involved?

Drive-by download; autorun propagation

Removable media; macro propagation

Social engineering; email propagation

Email attachment; network share propagation

A system administrator discovers that a server has been compromised. The malware has modified the operating system kernel to hide its processes and files from the standard administrative tools. The malware also maintains persistence by loading before the OS boots. Which malware type and component are most clearly demonstrated?

Rootkit with stealth techniques

Worm with a propagation mechanism

Ransomware with an encryption payload

A user receives an email that appears to be from a trusted colleague, with an attachment named 'invoice.pdf.exe'. The user opens the attachment, which installs a backdoor. Which distribution vector and malware type are involved?

Social engineering via phone; Ransomware

EC-CouncilDigital Forensics Essentials

Domain 7Objective 1

Malware Types, Components, and Distribution DFE Practice Questions (Page 4)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

39questions here

8free pages

3concepts

Questions 16–20

16application · medium
A user reports that their computer is running slowly and displaying pop-up advertisements even when no browser is open. The user recently installed a free media player from a third-party website. Which malware type and distribution vector are most likely involved?
Select an answer first
17application · medium
A forensic examiner is analyzing a system where the user clicked a link in a chat message that led to a website. The website exploited a browser vulnerability to install malware that encrypts the user's files and displays a ransom note. Which malware type and distribution vector are involved?
Select an answer first
18expert · medium
A company is investigating a malware outbreak. The malware was distributed via a malicious email attachment that contained a macro. When the macro ran, it downloaded a payload that spread to other systems via network shares. Which distribution vector and propagation mechanism are involved?
Select an answer first
19application · medium
A system administrator discovers that a server has been compromised. The malware has modified the operating system kernel to hide its processes and files from the standard administrative tools. The malware also maintains persistence by loading before the OS boots. Which malware type and component are most clearly demonstrated?
Select an answer first
20application · medium
A user receives an email that appears to be from a trusted colleague, with an attachment named 'invoice.pdf.exe'. The user opens the attachment, which installs a backdoor. Which distribution vector and malware type are involved?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.