Malware Forensics ECSS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A malware analyst is tasked with analyzing a new ransomware sample. The analyst wants to first determine whether the sample is packed and whether it contains any embedded URLs for C2 communication. The analyst also needs to avoid executing the sample until the environment is fully prepared. Which sequence of steps is most appropriate?

   • AExecute the sample in a sandbox immediately to see what it does, then perform static analysis
   • BPerform static analysis (file fingerprinting, string extraction) first, then set up the dynamic analysis environment
   • CSet up the dynamic analysis environment first, then execute the sample and observe behavior
   • DOnly perform static analysis and skip dynamic analysis to save time
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is analyzing a suspected keylogger in a controlled VM. The analyst executes the sample and observes that the process creates a file in the startup folder and then attempts to connect to an external IP. Which dynamic analysis observation is most indicative of a persistence mechanism?

   • AThe process opens a log file in the temp directory.
   • BThe process attempts to connect to an external IP.
   • CThe process creates a file in the startup folder.
   • DThe process uses high CPU usage.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary role of malware forensics within a digital forensics investigation?

   • ATo prevent malware from infecting a system by installing antivirus software
   • BTo identify, analyze, and document malicious software and its effects on a compromised system
   • CTo monitor network traffic in real time for intrusion detection
   • DTo recover deleted files from a suspect's hard drive
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst has completed dynamic analysis of a banking trojan and must produce a report for the incident response team. Which section is most important to include for the team to quickly remediate the infection?

   • AIndicators of compromise (IOCs) such as file hashes, C2 domains, and registry keys
   • BThe malware's source code, if available
   • CA list of all antivirus vendors that detect the sample
   • DThe analyst's personal opinion about the malware's author
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why are virtual machines commonly used in malware analysis environments?

   • AThey provide real-time antivirus protection
   • BThey automatically remove malware from the system
   • CThey allow analysts to take snapshots and revert to a clean state after analysis
   • DThey are faster than physical machines for executing malware
   Reveal Solution Discussion Select an answer first