A malware analyst is performing static analysis on a suspicious binary. Which activity is part of static analysis?

Examining the binary's strings and file metadata

Monitoring the binary's registry changes during execution

Observing the binary's CPU usage while running

Running the binary in a sandbox to observe network traffic

What is the primary goal of the recovery phase in malware incident response?

To identify the malware strain and its capabilities

To collect and preserve evidence for legal proceedings

To restore affected systems to normal operation using clean backups and verify their integrity

To isolate the infected systems from the rest of the network

An organization discovers that a worm has been spreading across its network by exploiting a vulnerability in a network service. The worm is also dropping a backdoor on infected systems. Which containment strategy is MOST effective in stopping the worm's spread?

Segment the network and block the vulnerable service at the firewall

Run a full antivirus scan on all systems

Disconnect all infected systems from the network

Patch the vulnerability on all systems

A company has suffered a malware outbreak that infected several servers and workstations. The malware is a polymorphic virus that has modified system files and created scheduled tasks. The incident response team has contained the infection and is now planning eradication. Which eradication approach is MOST effective given the polymorphic nature of the malware?

Run a full antivirus scan on all affected systems

Use a system restore point from before the infection

Manually delete all scheduled tasks and restore system files from backup

Reimage all affected systems from a known-clean image

Which of the following lists the phases of malware incident response in the correct order?

Preparation, Detection, Eradication, Containment, Recovery, Lessons Learned

Detection, Preparation, Containment, Recovery, Eradication, Lessons Learned

Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned

Containment, Detection, Eradication, Preparation, Recovery, Lessons Learned

EC-CouncilCertified Incident Handler

Domain 2Objective 2

Handling and Responding to Malware Incidents ECIH Practice Questions (Page 5)

Part of the First Response and Malware Incidents domain, which makes up ~22% of our current practice bank.

57questions here

12free pages

11concepts

Questions 21–25

21application · easy
A malware analyst is performing static analysis on a suspicious binary. Which activity is part of static analysis?
Select an answer first
22foundation · easy
What is the primary goal of the recovery phase in malware incident response?
Select an answer first
23application · medium
An organization discovers that a worm has been spreading across its network by exploiting a vulnerability in a network service. The worm is also dropping a backdoor on infected systems. Which containment strategy is MOST effective in stopping the worm's spread?
Select an answer first
24expert · hard
A company has suffered a malware outbreak that infected several servers and workstations. The malware is a polymorphic virus that has modified system files and created scheduled tasks. The incident response team has contained the infection and is now planning eradication. Which eradication approach is MOST effective given the polymorphic nature of the malware?
Select an answer first
25foundation · easy
Which of the following lists the phases of malware incident response in the correct order?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.