Malware Fundamentals GOAA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization has experienced a malware outbreak. The initial infection occurred when an employee opened a malicious attachment. The malware then created a scheduled task and a Windows service to maintain persistence. Later, the malware began spreading to other computers on the network. Which malware lifecycle stages are illustrated?

   • AExploitation, persistence, and propagation
   • BInfection, persistence, and execution
   • CDelivery, persistence, and propagation
   • DDelivery, execution, and objective
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   During an incident response engagement, you determine that an employee clicked a link in a phishing email, which led to a drive-by download. The downloaded payload then created a scheduled task that runs a PowerShell script every hour. The script periodically downloads additional modules from a command-and-control server. Which sequence best represents the malware lifecycle stages observed?

   • ADelivery → Exploitation → Installation → Persistence → Command and Control
   • BReconnaissance → Weaponization → Delivery → Exploitation → Actions on Objectives
   • CDelivery → Installation → Obfuscation → Persistence → Data Exfiltration
   • DInitial Infection → Execution → Persistence → Privilege Escalation → Lateral Movement
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A malware analyst needs to determine whether a suspicious executable modifies the Windows registry and creates network connections. The analyst has a controlled lab environment with a snapshot-capable virtual machine. Which approach would most directly reveal the runtime behavior?

   • AString extraction to look for registry paths and URLs
   • BFile hash lookup in a public malware database
   • CDynamic analysis in a sandboxed VM with process monitoring and network logging
   • DStatic analysis using a disassembler to read the machine code
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security analyst is reviewing an alert about a suspicious file that was downloaded from a website. The file is a PDF that, when opened, exploits a vulnerability in the PDF reader to execute a shellcode. The shellcode then downloads and runs a remote access trojan (RAT). Which stage of the malware lifecycle does the shellcode represent?

   • AExploitation
   • BDelivery
   • CPersistence
   • DCommand and Control
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A malware analyst is examining a suspicious binary. Static analysis reveals that the file has a high entropy section and imports only a few Windows API functions. When the analyst runs the binary in a virtual machine, it immediately exits without performing any malicious actions. However, when run on a physical machine, it executes its payload. Which evasion techniques is the malware most likely using?

   • AEncryption and anti-debugging
   • BPolymorphism and metamorphism
   • CObfuscation and code signing
   • DPacking and anti-sandboxing
   Reveal Solution Discussion Select an answer first