1What is the primary definition of malware in the context of digital evidence analysis?
A.Software designed to improve system performance
B.Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system
C.Hardware components that fail due to overheating
D.Network protocols used for secure communication
Correct Answer: Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system
Explanation:Malware is a contraction for 'malicious software' and encompasses any program or file that is harmful to a computer user.
Incorrect! Try again.
2Which of the following is a common technique used by attackers to spread malware via email?
A.Port Scanning
B.Phishing
C.SQL Injection
D.Packet Sniffing
Correct Answer: Phishing
Explanation:Phishing involves sending fraudulent emails resembling reputable sources to induce individuals to reveal personal information or download malicious attachments.
Incorrect! Try again.
3What is a 'Drive-by Download'?
A.Downloading software from a physical drive
B.Unintended download of malicious code by visiting a compromised website
C.Manually downloading a file from an email
D.Copying files from a USB stick
Correct Answer: Unintended download of malicious code by visiting a compromised website
Explanation:Drive-by downloads occur when a user visits a website that exploits browser vulnerabilities to install malware without the user's knowledge.
Incorrect! Try again.
4Which term describes malicious advertisements used to distribute malware?
A.Adware
B.Malvertising
C.Spyware
D.Ransomware
Correct Answer: Malvertising
Explanation:Malvertising involves injecting malicious code into legitimate online advertising networks to infect users who view the ads.
Incorrect! Try again.
5What is the primary goal of Malware Forensics?
A.To repair broken hardware
B.To design new antivirus software
C.To understand the capabilities, origin, and impact of a malicious sample
D.To increase network speed
Correct Answer: To understand the capabilities, origin, and impact of a malicious sample
Explanation:Malware forensics focuses on analyzing malicious code to determine what it does, how it works, and who created it to support incident response.
Incorrect! Try again.
6Which analysis type involves examining the malware without executing it?
A.Dynamic Analysis
B.Static Analysis
C.Behavioral Analysis
D.Memory Forensics
Correct Answer: Static Analysis
Explanation:Static analysis involves reviewing the code, structure, and metadata of a file without running it to ensure safety during the initial examination.
Incorrect! Try again.
7Which environment is most recommended for performing malware analysis to prevent infection of the host system?
A.Production Server
B.The analyst's personal laptop
C.An isolated Virtual Machine (VM) or Sandbox
D.A public Wi-Fi network
Correct Answer: An isolated Virtual Machine (VM) or Sandbox
Explanation:Isolated environments like VMs ensure that if the malware executes, the damage is contained and does not spread to the host or network.
Incorrect! Try again.
8In Static Analysis, what is the purpose of calculating the file hash (MD5, SHA256)?
A.To decrypt the file
B.To execute the file safely
C.To identify the file uniquely and check against databases like VirusTotal
D.To compress the file size
Correct Answer: To identify the file uniquely and check against databases like VirusTotal
Explanation:Hashes act as a digital fingerprint, allowing analysts to identify known malware variants without analyzing the code from scratch.
Incorrect! Try again.
9What tool is commonly used in static analysis to extract readable text strings from a binary?
A.Strings
B.Wireshark
C.Process Monitor
D.Fiddler
Correct Answer: Strings
Explanation:The 'Strings' utility extracts ASCII and Unicode characters from a binary, often revealing IP addresses, URLs, or file paths.
Incorrect! Try again.
10What does 'packing' refer to in the context of malware?
A.Zipping a file for email
B.Compressing or encrypting the executable to hide its code and evade detection
C.Adding more features to the malware
D.Bundling malware with legitimate software
Correct Answer: Compressing or encrypting the executable to hide its code and evade detection
Explanation:Packing obfuscates the malware's true code, making static analysis difficult until the code is unpacked in memory.
Incorrect! Try again.
11Which file format is the standard executable format for Windows, often analyzed during malware forensics?
A.ELF
B.PE (Portable Executable)
C.Mach-O
D.APK
Correct Answer: PE (Portable Executable)
Explanation:The PE format is the standard for executables, object code, and DLLs in Windows operating systems.
Incorrect! Try again.
12When analyzing a suspicious PDF, what specific element is often looked for as a vector for malicious code?
A.Text formatting
B.JavaScript
C.Image resolution
D.Page margins
Correct Answer: JavaScript
Explanation:Attackers often embed malicious JavaScript within PDFs to exploit vulnerabilities in PDF readers when the document is opened.
Incorrect! Try again.
13What is a common indicator of a malicious Microsoft Word document?
A.The use of Arial font
B.The presence of VBA Macros (Visual Basic for Applications)
C.The file size being under 1MB
D.The document having a .docx extension
Correct Answer: The presence of VBA Macros (Visual Basic for Applications)
Explanation:VBA Macros are frequently used to download and execute payloads when a user enables content in a Word document.
Incorrect! Try again.
14Which tool is specifically designed to analyze the structure of OLE (Object Linking and Embedding) streams in Office documents?
A.Oledump.py
B.Nmap
C.Metasploit
D.Burp Suite
Correct Answer: Oledump.py
Explanation:Oledump.py is a standard tool for analyzing OLE files (like Word documents) to identify and extract malicious macro streams.
Incorrect! Try again.
15What is 'Dynamic Malware Analysis'?
A.Reading the source code
B.Running the malware in a controlled environment to observe its behavior
C.Checking the file creation date
D.Scanning the file with an antivirus
Correct Answer: Running the malware in a controlled environment to observe its behavior
Explanation:Dynamic analysis involves executing the sample to monitor its interaction with the file system, registry, and network.
Incorrect! Try again.
16Which of the following is a risk associated with Dynamic Analysis?
A.The malware might detect the virtual environment and stop running
B.It requires access to the source code
C.It cannot identify network traffic
D.It is only useful for text files
Correct Answer: The malware might detect the virtual environment and stop running
Explanation:Many modern malware strains employ anti-VM or anti-sandbox techniques to remain dormant if they detect they are being analyzed.
Incorrect! Try again.
17What is the function of a 'snapshot' in a virtual machine during malware analysis?
A.To take a picture of the malware author
B.To save the state of the VM so it can be reverted after infection
C.To record the network traffic
D.To print the code
Correct Answer: To save the state of the VM so it can be reverted after infection
Explanation:Snapshots allow analysts to quickly revert a VM to a clean state after executing malware, facilitating repeated testing.
Incorrect! Try again.
18Which tool is widely used to monitor real-time file system, registry, and process activity on Windows?
A.Process Monitor (ProcMon)
B.Putty
C.FileZilla
D.VLC
Correct Answer: Process Monitor (ProcMon)
Explanation:ProcMon is a Sysinternals tool that captures real-time file system, registry, and process/thread activity.
Incorrect! Try again.
19In dynamic analysis, what does observing a change in the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' registry key usually indicate?
A.The system is updating
B.The malware is establishing persistence to run on startup
C.The browser is clearing cache
D.The screen resolution is changing
Correct Answer: The malware is establishing persistence to run on startup
Explanation:The 'Run' keys are common locations for malware to place entries ensuring it executes every time the computer boots.
Incorrect! Try again.
20What is 'Process Injection'?
A.Installing a new process via CD
B.Code belonging to one process being written into the address space of another process
C.Stopping a process efficiently
D.Monitoring a process for errors
Correct Answer: Code belonging to one process being written into the address space of another process
Explanation:Malware uses process injection to hide within legitimate processes (like explorer.exe) to evade detection and bypass firewalls.
Incorrect! Try again.
21What is a 'Mutex' (Mutual Exclusion) object often used for by malware?
A.To encrypt user files
B.To ensure only one instance of the malware runs at a time
C.To connect to the internet
D.To delete system logs
Correct Answer: To ensure only one instance of the malware runs at a time
Explanation:Malware authors create a named Mutex to mark the system as infected, preventing multiple instances from running and causing conflicts.
Incorrect! Try again.
22Which network behavior is characteristic of C2 (Command and Control) communication?
A.High bandwidth video streaming
B.Periodic 'beaconing' signals to an external server
C.Local printing traffic
D.Windows Update downloads
Correct Answer: Periodic 'beaconing' signals to an external server
Explanation:Malware often sends regular signals (beacons) to a C2 server to check for new commands or exfiltrate data.
Incorrect! Try again.
23What is the purpose of using 'FakeNet' or 'INetSim' during dynamic analysis?
A.To increase internet speed
B.To simulate internet services (DNS, HTTP) so malware thinks it is online
C.To hack into the malware author's computer
D.To block all network traffic permanently
Correct Answer: To simulate internet services (DNS, HTTP) so malware thinks it is online
Explanation:These tools simulate network services, allowing the malware to execute its network functions while keeping the analysis environment isolated from the real internet.
Incorrect! Try again.
24What is a Fileless Malware attack?
A.Malware that deletes all files on a drive
B.Malware that exists primarily in memory without writing an executable file to the disk
C.Malware transmitted via paper
D.Malware that only targets empty files
Correct Answer: Malware that exists primarily in memory without writing an executable file to the disk
Explanation:Fileless malware leverages system tools and memory to execute malicious code, avoiding traditional file-scanning antivirus detection.
Incorrect! Try again.
25Which term refers to legitimate system tools (like PowerShell) abused by fileless malware?
A.LOLBins (Living off the Land Binaries)
B.Bloatware
C.Firmware
D.Shareware
Correct Answer: LOLBins (Living off the Land Binaries)
Explanation:LOLBins are legitimate binaries (like powershell.exe or wmic.exe) used by attackers to perform malicious actions while appearing legitimate.
Incorrect! Try again.
26Which of the following is a common entry point for fileless malware?
Explanation:Fileless malware often enters via web scripts that exploit browser vulnerabilities to inject code directly into memory.
Incorrect! Try again.
27What is the role of WMI (Windows Management Instrumentation) in fileless attacks?
A.It acts as a firewall
B.It is used for graphics rendering
C.It can be used to execute scripts and maintain persistence without files
D.It manages the mouse pointer
Correct Answer: It can be used to execute scripts and maintain persistence without files
Explanation:Attackers use WMI to subscribe to system events and trigger malicious scripts, allowing persistence without dropping files on disk.
Incorrect! Try again.
28How does Domain Generation Algorithm (DGA) help malware?
A.It generates random domain names to rendezvous with the C2 server, evading blacklists
B.It encrypts the hard drive
C.It speeds up the infection process
D.It generates strong passwords for the user
Correct Answer: It generates random domain names to rendezvous with the C2 server, evading blacklists
Explanation:DGAs dynamically generate a large number of domain names, making it difficult for defenders to block the C2 infrastructure as it constantly shifts.
Incorrect! Try again.
29Which tool is best suited for capturing and analyzing network packets during malware analysis?
A.Wireshark
B.Notepad++
C.Resource Hacker
D.RegEdit
Correct Answer: Wireshark
Explanation:Wireshark is the standard network protocol analyzer used to inspect packet-level data to understand malware communication.
Incorrect! Try again.
30What is 'import hashing' (Imphash)?
A.Hashing the file name
B.Hashing the list of imported functions to identify related malware samples
C.Hashing the user's password
D.Hashing the network traffic
Correct Answer: Hashing the list of imported functions to identify related malware samples
Explanation:Imphash calculates a hash based on the order of imported libraries and functions, helping track malware families that share the same import table structure.
Incorrect! Try again.
31What is a 'Trojan Horse'?
A.Self-replicating malware
B.Malware disguised as legitimate software to mislead users of its true intent
C.Malware that locks the screen
D.Hardware used to steal data
Correct Answer: Malware disguised as legitimate software to mislead users of its true intent
Explanation:A Trojan Horse appears to be useful software but delivers a malicious payload once installed.
Incorrect! Try again.
32Which component of the PE header contains information about the compilation time of the malware?
A.Time Date Stamp
B.Machine Type
C.Subsystem
D.Pointer to Symbol Table
Correct Answer: Time Date Stamp
Explanation:The Time Date Stamp in the FILE_HEADER indicates when the binary was compiled, though it can be spoofed.
Incorrect! Try again.
33What does the term 'Obfuscation' mean in malware analysis?
A.Deleting the code
B.Making the code difficult for humans and analysis tools to understand
C.Translating the code to English
D.Highlighting important code sections
Correct Answer: Making the code difficult for humans and analysis tools to understand
Explanation:Obfuscation techniques (like variable renaming or dead code insertion) are used to complicate reverse engineering efforts.
Incorrect! Try again.
34In the context of PDF analysis, what is a '/OpenAction'?
A.A command to close the file
B.A command that specifies an action to perform immediately upon opening the document
C.A permission setting
D.A font style
Correct Answer: A command that specifies an action to perform immediately upon opening the document
Explanation:/OpenAction is a PDF element often abused by malware to trigger malicious scripts immediately when the user opens the file.
Incorrect! Try again.
35What is 'Sandboxing'?
A.Playing a game
B.Automated dynamic analysis in a secure environment
C.Cleaning the computer case
D.Encrypting a hard drive
Correct Answer: Automated dynamic analysis in a secure environment
Explanation:Sandboxes allow for the automated execution of suspected files to generate reports on their behavior without human intervention.
Incorrect! Try again.
36Which of the following is a symptom of Ransomware?
A.The mouse moves slowly
B.Files are encrypted and a payment note is displayed
C.The web browser opens multiple tabs
D.The computer shuts down randomly
Correct Answer: Files are encrypted and a payment note is displayed
Explanation:Ransomware restricts access to the system or encrypts files and demands a ransom for the decryption key.
Incorrect! Try again.
37What is the primary difference between a Virus and a Worm?
A.Viruses encrypt files; Worms delete them
B.Viruses require a host file and user action to spread; Worms are self-replicating and spread automatically
C.Worms are only for Linux
D.Viruses are hardware-based
Correct Answer: Viruses require a host file and user action to spread; Worms are self-replicating and spread automatically
Explanation:The defining characteristic is propagation: Viruses attach to files and need execution; worms spread independently across networks.
Incorrect! Try again.
38Why might an analyst check 'Imported Functions' (Imports) in the PE header?
A.To see the file size
B.To guess what the malware is capable of (e.g., networking, file manipulation)
C.To check the author's name
D.To see the icon
Correct Answer: To guess what the malware is capable of (e.g., networking, file manipulation)
Explanation:Imports list the Windows APIs the malware uses. Seeing 'InternetOpen' suggests network capability; seeing 'WriteFile' suggests disk activity.
Incorrect! Try again.
39What does 'Shellcode' refer to in a malicious document?
A.The visual layout of the document
B.Machine code payload used to exploit a vulnerability
C.The name of the file
D.The password protection
Correct Answer: Machine code payload used to exploit a vulnerability
Explanation:Shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability.
Incorrect! Try again.
40Which tool allows an analyst to view active TCP and UDP connections in real-time on the host?
A.TCPView
B.Notepad
C.Calculator
D.Paint
Correct Answer: TCPView
Explanation:TCPView is a Sysinternals utility that shows detailed listings of all TCP and UDP endpoints on the system.
Incorrect! Try again.
41What is 'DLL Injection'?
A.Removing a DLL file
B.Forcing a process to load a malicious Dynamic Link Library (DLL)
C.Renaming a DLL file
D.Scanning DLLs for viruses
Correct Answer: Forcing a process to load a malicious Dynamic Link Library (DLL)
Explanation:DLL injection is a method used to run malicious code within the address space of another process by forcing it to load a malicious DLL.
Incorrect! Try again.
42What is the 'AutoOpen' macro in Word?
A.A macro that runs automatically when a document is opened
B.A macro that saves the file
C.A macro that prints the file
D.A macro that changes the font
Correct Answer: A macro that runs automatically when a document is opened
Explanation:AutoOpen is a specific VBA macro name that triggers automatically when a user opens the Word document, often used for initial infection.
Incorrect! Try again.
43How can fileless malware persist using the Windows Registry?
A.By deleting the registry
B.By storing malicious scripts in registry keys and invoking them via PowerShell
C.By changing the desktop background
D.By disabling the mouse
Correct Answer: By storing malicious scripts in registry keys and invoking them via PowerShell
Explanation:Fileless malware often hides the actual malicious code inside registry blobs and uses a small scheduled task or run key to execute it.
Incorrect! Try again.
44Which network protocol is commonly abused for data exfiltration because it is rarely blocked by firewalls?
A.DNS (Domain Name System)
B.ARP
C.DHCP
D.ICMP
Correct Answer: DNS (Domain Name System)
Explanation:DNS tunneling involves encoding stolen data into DNS queries, which usually pass through firewalls uninspected.
Incorrect! Try again.
45What is the purpose of 'API Hooking' in malware?
A.To fix bugs in Windows
B.To intercept function calls between the system and applications to modify or monitor behavior
C.To speed up the internet
D.To organize files
Correct Answer: To intercept function calls between the system and applications to modify or monitor behavior
Explanation:Rootkits and banking trojans use API hooking to intercept data (like keystrokes) or hide their presence from the OS.
Incorrect! Try again.
46Which section of a PE file typically contains the executable code?
A..text
B..data
C..rsrc
D..reloc
Correct Answer: .text
Explanation:The .text section is the standard location for the executable instructions (code) of the program.
Incorrect! Try again.
47When analyzing a suspicious URL found in malware, what should an analyst do?
A.Open it in their personal browser immediately
B.Investigate it using reputation services or a safe sandbox environment
C.Ignore it
D.Email the URL to friends
Correct Answer: Investigate it using reputation services or a safe sandbox environment
Explanation:Direct interaction is dangerous. Analysts check reputation (e.g., VirusTotal, WHOIS) or visit via a sandbox.
Incorrect! Try again.
48What is the primary characteristic of a 'Rootkit'?
A.It displays ads
B.It is designed to hide the existence of certain processes or programs from normal detection methods
C.It encrypts files
D.It spreads via USB
Correct Answer: It is designed to hide the existence of certain processes or programs from normal detection methods
Explanation:Rootkits operate at a deep level (often kernel level) to mask their presence and the presence of other malware.
Incorrect! Try again.
49What is 'Entropy' used for in static malware analysis?
A.To measure the file temperature
B.To measure the randomness of data, helping identify packed or encrypted code
C.To measure the network speed
D.To count the lines of code
Correct Answer: To measure the randomness of data, helping identify packed or encrypted code
Explanation:High entropy (randomness) usually indicates that the file is packed or encrypted, as compressed/encrypted data looks random.
Incorrect! Try again.
50Why is 'PowerShell' a frequent target for fileless malware?
A.It is not installed on most computers
B.It has deep access to the Windows API and system management functions without needing new binaries
C.It is a game engine
D.It is a web browser
Correct Answer: It has deep access to the Windows API and system management functions without needing new binaries
Explanation:PowerShell is a powerful, native administration tool. Malware uses it to perform complex actions directly in memory.
Incorrect! Try again.
Give Feedback
Help us improve by sharing your thoughts or reporting issues.