Interactive and Manual Malware Analyses GCED Practice Questions (Page 11)

Questions 51–54

1. 51foundation · easy

   Which of the following is a manual inspection method used to examine malware code?

   • AUsing an automated unpacker to unpack the sample
   • BReading the disassembled instructions in a debugger
   • CRunning a heuristic scanner to detect packers
   • DSubmitting the sample to a sandbox for behavioral analysis
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A malware analyst needs to analyze a sample that uses a known vulnerability to escalate privileges and then attempts to spread across the network. The analyst has a single analysis workstation with a hypervisor and a limited number of VMs. The analyst must observe the malware's propagation attempts without risking the corporate network. Which approach best balances safety and observability?

   • ACreate a small virtual network with two VMs: one infected and one uninfected, connected through a virtual switch that is isolated from the corporate network, and monitor traffic between them.
   • BUse a single VM with a host-only network and a packet capture tool to observe any outbound traffic.
   • CConnect the infected VM to the corporate network but block the malware's known ports at the firewall.
   • DRun the malware in a single VM with the network adapter set to 'not attached' and rely on static analysis for propagation behavior.
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   Which practice is essential for a safe malware analysis environment?

   • AUsing a virtual machine with snapshots and no network connectivity
   • BRunning the malware on a physical machine with internet access
   • CDisabling the firewall to allow malware to communicate freely
   • DSharing the analysis VM's folder with the host for easy file transfer
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   An analyst is examining a suspicious document that contains an embedded macro. The analyst wants to manually inspect the macro code without executing it. Which approach is most appropriate?

   • AExtract the macro source code using a tool like olevba or a manual VBA project extraction, then review the code for suspicious API calls.
   • BRun a hex dump of the document and search for ASCII strings like 'Shell' or 'PowerShell'.
   • COpen the document in a word processor with macros disabled and observe any pop-ups or messages.
   • DUse an automated sandbox to open the document and capture the resulting network traffic.
   Reveal Solution Discussion Select an answer first