A security analyst receives a suspicious executable from an internal user. The analyst wants to determine whether the file contains embedded strings that reveal command-and-control server addresses, without executing the file. Which analysis technique should be used?

Static analysis using a hex editor or string extraction tool

Signature-based scanning with the antivirus console

Behavioral monitoring on a production host

After a ransomware incident, the incident response team has contained the outbreak and eradicated the malware from all systems. However, they are unsure whether the attackers exfiltrated sensitive data. What should be the NEXT step in the incident response process?

Immediately restore all systems from backups

Perform a forensic investigation to determine the scope of data exfiltration

Conduct a post-incident analysis to review the attack and identify lessons learned

Notify law enforcement immediately

A security team discovers a file that, when executed, encrypts user documents and displays a ransom note. The same file also contains a module that logs keystrokes and sends them to a remote server. The file does not self-replicate. Which classification best describes this threat?

Trojan with ransomware and spyware payloads

Ransomware with spyware capabilities

A security administrator notices that a new piece of malware is spreading rapidly across the network. Traditional signature-based antivirus has not detected it. Which detection mechanism would be most effective at identifying this unknown malware based on its actions?

Behavioral detection that monitors for unusual file encryption and network connections

Heuristic detection that flags files based on code similarity to known malware

Static analysis of every file on the network

Signature-based detection with updated definitions

EC-CouncilCertified Security Specialist

Domain 3Objective 3

Malware Threats and Countermeasures ECSS Practice Questions (Page 1)

Part of the Ethical Hacking Fundamentals and Core Attacks domain, which makes up ~17% of our current practice bank.

46questions here

10free pages

6concepts

Questions 1–5

1expert · hard
An analyst is examining a malware sample that appears to be a legitimate system utility but also contains code that collects keystrokes and sends them to a remote server. Which classification best describes this malware?
Select an answer first
2application · medium
A security analyst receives a suspicious executable from an internal user. The analyst wants to determine whether the file contains embedded strings that reveal command-and-control server addresses, without executing the file. Which analysis technique should be used?
Select an answer first
3expert · hard
After a ransomware incident, the incident response team has contained the outbreak and eradicated the malware from all systems. However, they are unsure whether the attackers exfiltrated sensitive data. What should be the NEXT step in the incident response process?
Select an answer first
4expert · hard
A security team discovers a file that, when executed, encrypts user documents and displays a ransom note. The same file also contains a module that logs keystrokes and sends them to a remote server. The file does not self-replicate. Which classification best describes this threat?
Select an answer first
5application · medium
A security administrator notices that a new piece of malware is spreading rapidly across the network. Traditional signature-based antivirus has not detected it. Which detection mechanism would be most effective at identifying this unknown malware based on its actions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.