A malware analyst has a suspicious file that appears to be packed. The analyst wants to determine the malware's true functionality, but the file is designed to evade sandboxes by checking for virtual machine artifacts. Which approach is most appropriate?

Execute the file on a production host with monitoring

Submit the file to an online multi-scanner

Run the file in a standard sandbox and rely on the generated report

Perform static unpacking and then analyze the unpacked code

A user clicks a link in a phishing email that leads to a website hosting an exploit kit. The exploit kit silently installs a backdoor on the user's system. Which malware infection vector is being used?

Exploit kit via malicious download

During a malware incident, the response team has identified the infected systems and isolated them from the network. What is the PRIMARY goal of the containment phase?

To restore systems to normal operation

To preserve evidence for legal action

To identify the root cause of the infection

To prevent the malware from spreading further

An organization wants to detect malware that is polymorphic and changes its code each time it infects a new system. Which detection mechanism is most likely to identify this malware?

Allowlisting known applications

EC-CouncilCertified Security Specialist

Domain 3Objective 3

Malware Threats and Countermeasures ECSS Practice Questions (Page 5)

Part of the Ethical Hacking Fundamentals and Core Attacks domain, which makes up ~17% of our current practice bank.

46questions here

10free pages

6concepts

Questions 21–25

21foundation · easy
A malware analyst runs a suspicious file inside a virtual machine to observe its behavior, including file system changes and network connections. Which analysis technique is being used?
Select an answer first
22expert · hard
A malware analyst has a suspicious file that appears to be packed. The analyst wants to determine the malware's true functionality, but the file is designed to evade sandboxes by checking for virtual machine artifacts. Which approach is most appropriate?
Select an answer first
23application · medium
A user clicks a link in a phishing email that leads to a website hosting an exploit kit. The exploit kit silently installs a backdoor on the user's system. Which malware infection vector is being used?
Select an answer first
24application · medium
During a malware incident, the response team has identified the infected systems and isolated them from the network. What is the PRIMARY goal of the containment phase?
Select an answer first
25application · medium
An organization wants to detect malware that is polymorphic and changes its code each time it infects a new system. Which detection mechanism is most likely to identify this malware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.