Malware Forensics ECSS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a key requirement for a malware analysis environment?

   • AIt must have internet access to allow the malware to update itself
   • BIt must be isolated from production networks to prevent malware from spreading
   • CIt must use the same operating system as the victim's production environment
   • DIt must be a physical machine to ensure accurate results
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is setting up a malware analysis lab. The lab uses a VM with a snapshot taken before each analysis. The VM is connected to a virtual network that blocks outbound traffic except to a simulated C2 server. Why is this network configuration important for dynamic analysis?

   • AIt prevents the malware from spreading to the production network.
   • BIt allows the malware to run faster.
   • CIt ensures the malware cannot detect that it is in a VM.
   • DIt allows the analyst to capture the malware's encryption keys.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An analyst is writing a forensic report on a ransomware infection. The report must be suitable for both legal proceedings and incident response. The analyst has documented the file hashes, C2 domains, and persistence mechanisms. Which additional element is most important to include for legal proceedings?

   • AThe malware's source code, if available
   • BA list of all antivirus products that detect the sample
   • CA detailed timeline of the analysis steps and the analyst's qualifications
   • DThe analyst's personal opinion about the malware's origin
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   During dynamic analysis of a ransomware sample, the analyst observes that the malware creates a scheduled task that runs a PowerShell script at system startup. Which persistence mechanism is the malware using?

   • AStartup folder
   • BRegistry run key
   • CScheduled task
   • DWindows service
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An analyst is setting up a malware analysis lab for a team that will analyze both Windows and Linux malware. The lab has limited hardware and must support multiple concurrent analyses. Which setup is most effective?

   • AUse a single physical machine with dual-boot Windows and Linux
   • BUse a single VM with both Windows and Linux installed in a virtualized environment
   • CUse a hypervisor with multiple VMs, each with a snapshot and a virtual network that can be isolated per analysis
   • DUse online sandboxes for all analyses
   Reveal Solution Discussion Select an answer first