Interactive and Manual Malware Analyses GCED Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary goal of static analysis in an interactive malware analysis session?

   • ATo determine the malware's command-and-control server by monitoring network traffic
   • BTo identify the malware's persistence mechanism by checking the registry during execution
   • CTo execute the malware and observe its runtime behavior
   • DTo infer malware functionality without executing it
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which activity is part of static analysis?

   • ASetting a breakpoint to pause execution at a specific instruction
   • BMonitoring file system changes while the malware runs
   • CCapturing network packets to see what domains the malware contacts
   • DExamining the import table to see which Windows APIs the malware calls
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of an IOC extracted from malware analysis?

   • AThe date of analysis
   • BThe malware's MD5 hash
   • CThe version of the analysis tool
   • DThe name of the analyst
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst receives a suspicious executable from a vendor and needs to observe its behavior in a controlled environment. The analyst has a dedicated analysis workstation with a hypervisor and several pre-built VMs. The sample is known to attempt network communication and write to the registry. Which setup step is most important to prevent the malware from affecting the corporate network while still allowing the analyst to observe its network behavior?

   • ADisable the VM's network adapter entirely so the malware cannot communicate at all.
   • BConnect the VM directly to the corporate network to see what the malware actually does in a real environment.
   • CPlace the VM on a NAT network and rely on the host firewall to block outbound traffic.
   • DConfigure the VM to use a host-only or isolated virtual network with a simulated Internet service (e.g., INetSim).
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During dynamic analysis of a trojan, an analyst observes that the malware creates a mutex named `Global\XyZ123`, writes a file to `%APPDATA%\Microsoft\update.exe`, and adds a registry Run key. Which of the following is the most complete set of IOCs to record for detection?

   • AThe SHA-256 hash of the original sample and the mutex name only.
   • BThe registry key path and the file's creation timestamp only.
   • CThe file path and the registry key path only, since mutexes are not persistent.
   • DThe mutex name, the file path, the registry key path, and the SHA-256 hash of the dropped file.
   Reveal Solution Discussion Select an answer first