What is a primary purpose of a malware forensics report?

To document findings in a clear and reproducible manner for legal or incident response use

To store the malware sample for future analysis

To provide a step-by-step guide for removing malware from infected systems

To advertise the analyst's skills to potential employers

Which Windows registry key is commonly used by malware to achieve persistence?

HKEY_CURRENT_USER\Control Panel\Appearance

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Hardware\DeviceMap\Keyboard

An analyst has a malware sample that is heavily obfuscated and uses anti-debugging techniques. The analyst needs to understand the malware's network behavior. Which approach is most appropriate?

Perform dynamic analysis in a controlled VM and capture network traffic

Use a debugger to step through the code and identify network calls

Submit the sample to an online sandbox without any isolation

Perform static analysis by extracting strings from the binary

EC-CouncilCertified Security Specialist

Domain 6Objective 7

Malware Forensics ECSS Practice Questions (Page 8)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

43questions here

9free pages

10concepts

Questions 36–40

36foundation · easy
Which of the following is a common persistence mechanism used by malware?
Select an answer first
37foundation · easy
What is a primary purpose of a malware forensics report?
Select an answer first
38application · medium
A security analyst discovers a file named 'invoice.pdf.exe' on a user's machine. The file, when executed, encrypts the user's documents and displays a ransom note. Which malware classification best describes this threat?
Select an answer first
39foundation · easy
Which Windows registry key is commonly used by malware to achieve persistence?
Select an answer first
40application · medium
An analyst has a malware sample that is heavily obfuscated and uses anti-debugging techniques. The analyst needs to understand the malware's network behavior. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Malware Forensics ECSS Practice Questions (Page 8)

Questions 36–40

Which of the following is a common persistence mechanism used by malware?

What is a primary purpose of a malware forensics report?

A security analyst discovers a file named 'invoice.pdf.exe' on a user's machine. The file, when executed, encrypts the user's documents and displays a ransom note. Which malware classification best describes this threat?

Which Windows registry key is commonly used by malware to achieve persistence?

An analyst has a malware sample that is heavily obfuscated and uses anti-debugging techniques. The analyst needs to understand the malware's network behavior. Which approach is most appropriate?

Keep studying — Digital Forensics Investigations