A security analyst observes that a workstation is encrypting files and displaying a ransom note. The analyst also notices that the malware created a scheduled task to re-run the encryption at every reboot. How should the malware be classified?

Ransomware with a persistence mechanism

A worm that spreads via network shares

A trojan disguised as legitimate software

A spyware that collects keystrokes

What is the primary purpose of dynamic malware analysis?

To calculate the malware's hash for identification

To extract strings from the malware binary

To observe the malware's behavior and effects on a system when executed

To examine the malware's code without executing it

What is a key limitation of static malware analysis?

It cannot reveal the malware's behavior when executed

It is too slow for practical use in investigations

It always detects packed or obfuscated malware

It requires a fully isolated network environment

EC-CouncilCertified Security Specialist

Domain 6Objective 7

Malware Forensics ECSS Practice Questions (Page 6)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

43questions here

9free pages

10concepts

Questions 26–30

26application · easy
A security analyst observes that a workstation is encrypting files and displaying a ransom note. The analyst also notices that the malware created a scheduled task to re-run the encryption at every reboot. How should the malware be classified?
Select an answer first
27foundation · easy
Which static analysis technique involves calculating a cryptographic hash of a malware file to identify it uniquely?
Select an answer first
28foundation · easy
What is the primary purpose of dynamic malware analysis?
Select an answer first
29foundation · easy
What is a key limitation of static malware analysis?
Select an answer first
30foundation · easy
Which tool is commonly used for debugging malware to step through its execution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Malware Forensics ECSS Practice Questions (Page 6)

Questions 26–30

A security analyst observes that a workstation is encrypting files and displaying a ransom note. The analyst also notices that the malware created a scheduled task to re-run the encryption at every reboot. How should the malware be classified?

Which static analysis technique involves calculating a cryptographic hash of a malware file to identify it uniquely?

What is the primary purpose of dynamic malware analysis?

What is a key limitation of static malware analysis?

Which tool is commonly used for debugging malware to step through its execution?

Keep studying — Digital Forensics Investigations