Malware Forensics ECSS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An incident responder has completed static and dynamic analysis of a worm that spreads via USB drives. The responder must now produce a forensic report that will be used in legal proceedings. Which section is most critical to include to ensure the report is admissible and useful?

   • AA summary of the malware's author's likely motivation based on the code style
   • BA clear chain of custody for the evidence and the analysis environment, including hashes of the sample
   • CA recommendation to immediately delete all USB drives from the company
   • DA detailed list of all the analyst's personal opinions about the malware's sophistication
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which type of malware is designed to encrypt a victim's files and demand payment for the decryption key?

   • AWorm
   • BSpyware
   • CRansomware
   • DTrojan
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst is performing static analysis on a suspicious binary. The binary has a high entropy score and a very small import table. What does this combination most likely indicate?

   • AThe binary is written in a high-level language like C++
   • BThe binary is a legitimate application with no malicious code
   • CThe binary is a simple script compiled to an executable
   • DThe binary is packed or obfuscated
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst receives a suspicious executable from a compromised workstation. The file is flagged by antivirus as a trojan, but the analyst needs to confirm the indicator before submitting it to the sandbox. The analyst hashes the file, extracts printable strings, and examines the PE header. Which conclusion can the analyst draw from these static steps alone?

   • AThe file is a worm because the PE header indicates a network service.
   • BThe file is benign because no suspicious strings were found.
   • CThe file is likely packed because the entropy is high and the import table is minimal.
   • DThe file is malicious because the hash matches a known malware sample.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A digital forensics investigator is called to analyze a machine infected with a worm. The investigator needs to produce a report that explains how the worm spreads and what indicators of compromise (IOCs) were found. Which approach best aligns with the role of malware forensics in this investigation?

   • APerform static and dynamic analysis to identify the worm's propagation method and extract IOCs, then document findings in a report
   • BImmediately reimage the machine to remove the worm and then write a brief summary
   • CInterview the user to determine how the worm was downloaded and then write a report
   • DRun a full antivirus scan and report the detection name
   Reveal Solution Discussion Select an answer first