A malware analyst has a suspicious file and needs to observe its runtime behavior, including network connections and file system changes, in a controlled environment. Which approach should be used?

Dynamic analysis in a sandboxed virtual machine

Static analysis with a disassembler

A company has experienced multiple malware infections through unpatched software vulnerabilities. The IT team wants to implement a control that directly reduces the risk of exploit-based malware. Which measure is most directly effective?

Implement a robust patch management program

Increase user awareness training

An organization has a mix of legacy systems that cannot be patched and modern systems that are fully patched. They want to reduce the risk of malware infection via exploit kits that target browser vulnerabilities. Which control would be most effective given the constraint that legacy systems cannot be patched?

Replace all legacy systems immediately

Deploy a web proxy with URL filtering and block known malicious sites

Disable JavaScript in all browsers

Increase the frequency of antivirus signature updates

A small business wants to reduce the risk of malware infections from email attachments and malicious downloads. They have a limited budget and no dedicated security staff. Which countermeasure should they prioritize?

Disable all email attachments at the gateway

Purchase an expensive next-generation firewall for every user

Implement a robust user awareness training program

Rely solely on free antivirus software

EC-CouncilCertified Security Specialist

Domain 3Objective 3

Malware Threats and Countermeasures ECSS Practice Questions (Page 8)

Part of the Ethical Hacking Fundamentals and Core Attacks domain, which makes up ~17% of our current practice bank.

46questions here

10free pages

6concepts

Questions 36–40

36application · medium
A malware analyst has a suspicious file and needs to observe its runtime behavior, including network connections and file system changes, in a controlled environment. Which approach should be used?
Select an answer first
37application · medium
A company has experienced multiple malware infections through unpatched software vulnerabilities. The IT team wants to implement a control that directly reduces the risk of exploit-based malware. Which measure is most directly effective?
Select an answer first
38foundation · easy
Which malware detection approach relies on a database of known malware patterns and is effective against known threats but cannot detect new or unknown malware?
Select an answer first
39expert · hard
An organization has a mix of legacy systems that cannot be patched and modern systems that are fully patched. They want to reduce the risk of malware infection via exploit kits that target browser vulnerabilities. Which control would be most effective given the constraint that legacy systems cannot be patched?
Select an answer first
40application · medium
A small business wants to reduce the risk of malware infections from email attachments and malicious downloads. They have a limited budget and no dedicated security staff. Which countermeasure should they prioritize?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Malware Threats and Countermeasures ECSS Practice Questions (Page 8)

Questions 36–40

A malware analyst has a suspicious file and needs to observe its runtime behavior, including network connections and file system changes, in a controlled environment. Which approach should be used?

A company has experienced multiple malware infections through unpatched software vulnerabilities. The IT team wants to implement a control that directly reduces the risk of exploit-based malware. Which measure is most directly effective?

Which malware detection approach relies on a database of known malware patterns and is effective against known threats but cannot detect new or unknown malware?

A small business wants to reduce the risk of malware infections from email attachments and malicious downloads. They have a limited budget and no dedicated security staff. Which countermeasure should they prioritize?

Keep studying — Ethical Hacking Fundamentals and Core Attacks