Malware as a Collection Source GCTI Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which practice is ethically appropriate when handling malware samples in a threat intelligence context?

   • AReleasing malware samples publicly to raise awareness
   • BDeploying malware samples on production systems to test defenses
   • CUsing malware samples only for authorized defensive security purposes and not for malicious activities
   • DSharing malware samples with other organizations without any restrictions
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An intelligence analyst is triaging a set of malware samples from a recent campaign. One sample is a trojan that downloads additional payloads, another is a worm that spreads via removable drives, and a third is ransomware that encrypts files. The analyst must prioritize which sample to analyze first to support incident response. Which sample should be prioritized, and why?

   • AThe ransomware, because it causes direct financial damage through encryption.
   • BAll samples equally, because each provides unique intelligence value.
   • CThe trojan, because it downloads additional payloads that could include more dangerous malware.
   • DThe worm, because its self-propagation mechanism poses the highest immediate risk of widespread infection.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which technique is an example of static malware analysis?

   • AExamining the malware's file hash and embedded strings without executing it
   • BRunning the malware in a sandbox to observe its network connections
   • CMonitoring the malware's registry changes in a controlled environment
   • DDebugging the malware with a debugger to trace its execution flow
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which malware type is most likely to provide intelligence about an adversary's command-and-control (C2) infrastructure?

   • AA worm that spreads automatically across networks without user interaction
   • BA trojan that establishes persistent backdoor access and communicates with a remote server
   • CRansomware that encrypts files and displays a ransom note
   • DA keylogger that records keystrokes and stores them locally
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A malware analyst is working with a sample that is known to be a keylogger. The analyst wants to extract the list of keystrokes it captures and the file path where it stores the logged data. Which analysis technique would be most efficient for this purpose?

   • AString analysis: search the binary for the word 'log' to find the file path.
   • BDynamic analysis: execute the sample in a sandbox and monitor file system and registry changes to identify the log file and its location.
   • CMemory analysis: dump the process memory after execution and search for keystroke data.
   • DStatic analysis: disassemble the binary and trace every API call related to keyboard input.
   Reveal Solution Discussion Select an answer first