1What is the primary definition of malware in the context of digital evidence analysis?
A.Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system
B.Network protocols used for secure communication
C.Software designed to improve system performance
D.Hardware components that fail due to overheating
Correct Answer: Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system
Explanation:
Malware is a contraction for 'malicious software' and encompasses any program or file that is harmful to a computer user.
Incorrect! Try again.
2Which of the following is a common technique used by attackers to spread malware via email?
A.Packet Sniffing
B.SQL Injection
C.Phishing
D.Port Scanning
Correct Answer: Phishing
Explanation:
Phishing involves sending fraudulent emails resembling reputable sources to induce individuals to reveal personal information or download malicious attachments.
Incorrect! Try again.
3What is a 'Drive-by Download'?
A.Unintended download of malicious code by visiting a compromised website
B.Copying files from a USB stick
C.Downloading software from a physical drive
D.Manually downloading a file from an email
Correct Answer: Unintended download of malicious code by visiting a compromised website
Explanation:
Drive-by downloads occur when a user visits a website that exploits browser vulnerabilities to install malware without the user's knowledge.
Incorrect! Try again.
4Which term describes malicious advertisements used to distribute malware?
A.Adware
B.Spyware
C.Ransomware
D.Malvertising
Correct Answer: Malvertising
Explanation:
Malvertising involves injecting malicious code into legitimate online advertising networks to infect users who view the ads.
Incorrect! Try again.
5What is the primary goal of Malware Forensics?
A.To design new antivirus software
B.To understand the capabilities, origin, and impact of a malicious sample
C.To increase network speed
D.To repair broken hardware
Correct Answer: To understand the capabilities, origin, and impact of a malicious sample
Explanation:
Malware forensics focuses on analyzing malicious code to determine what it does, how it works, and who created it to support incident response.
Incorrect! Try again.
6Which analysis type involves examining the malware without executing it?
A.Memory Forensics
B.Behavioral Analysis
C.Static Analysis
D.Dynamic Analysis
Correct Answer: Static Analysis
Explanation:
Static analysis involves reviewing the code, structure, and metadata of a file without running it to ensure safety during the initial examination.
Incorrect! Try again.
7Which environment is most recommended for performing malware analysis to prevent infection of the host system?
A.The analyst's personal laptop
B.An isolated Virtual Machine (VM) or Sandbox
C.A public Wi-Fi network
D.Production Server
Correct Answer: An isolated Virtual Machine (VM) or Sandbox
Explanation:
Isolated environments like VMs ensure that if the malware executes, the damage is contained and does not spread to the host or network.
Incorrect! Try again.
8In Static Analysis, what is the purpose of calculating the file hash (MD5, SHA256)?
A.To execute the file safely
B.To decrypt the file
C.To compress the file size
D.To identify the file uniquely and check against databases like VirusTotal
Correct Answer: To identify the file uniquely and check against databases like VirusTotal
Explanation:
Hashes act as a digital fingerprint, allowing analysts to identify known malware variants without analyzing the code from scratch.
Incorrect! Try again.
9What tool is commonly used in static analysis to extract readable text strings from a binary?
A.Strings
B.Process Monitor
C.Fiddler
D.Wireshark
Correct Answer: Strings
Explanation:
The 'Strings' utility extracts ASCII and Unicode characters from a binary, often revealing IP addresses, URLs, or file paths.
Incorrect! Try again.
10What does 'packing' refer to in the context of malware?
A.Compressing or encrypting the executable to hide its code and evade detection
B.Bundling malware with legitimate software
C.Zipping a file for email
D.Adding more features to the malware
Correct Answer: Compressing or encrypting the executable to hide its code and evade detection
Explanation:
Packing obfuscates the malware's true code, making static analysis difficult until the code is unpacked in memory.
Incorrect! Try again.
11Which file format is the standard executable format for Windows, often analyzed during malware forensics?
A.Mach-O
B.APK
C.PE (Portable Executable)
D.ELF
Correct Answer: PE (Portable Executable)
Explanation:
The PE format is the standard for executables, object code, and DLLs in Windows operating systems.
Incorrect! Try again.
12When analyzing a suspicious PDF, what specific element is often looked for as a vector for malicious code?
A.Image resolution
B.JavaScript
C.Text formatting
D.Page margins
Correct Answer: JavaScript
Explanation:
Attackers often embed malicious JavaScript within PDFs to exploit vulnerabilities in PDF readers when the document is opened.
Incorrect! Try again.
13What is a common indicator of a malicious Microsoft Word document?
A.The file size being under 1MB
B.The use of Arial font
C.The document having a .docx extension
D.The presence of VBA Macros (Visual Basic for Applications)
Correct Answer: The presence of VBA Macros (Visual Basic for Applications)
Explanation:
VBA Macros are frequently used to download and execute payloads when a user enables content in a Word document.
Incorrect! Try again.
14Which tool is specifically designed to analyze the structure of OLE (Object Linking and Embedding) streams in Office documents?
A.Nmap
B.Oledump.py
C.Metasploit
D.Burp Suite
Correct Answer: Oledump.py
Explanation:
Oledump.py is a standard tool for analyzing OLE files (like Word documents) to identify and extract malicious macro streams.
Incorrect! Try again.
15What is 'Dynamic Malware Analysis'?
A.Running the malware in a controlled environment to observe its behavior
B.Checking the file creation date
C.Reading the source code
D.Scanning the file with an antivirus
Correct Answer: Running the malware in a controlled environment to observe its behavior
Explanation:
Dynamic analysis involves executing the sample to monitor its interaction with the file system, registry, and network.
Incorrect! Try again.
16Which of the following is a risk associated with Dynamic Analysis?
A.The malware might detect the virtual environment and stop running
B.It is only useful for text files
C.It cannot identify network traffic
D.It requires access to the source code
Correct Answer: The malware might detect the virtual environment and stop running
Explanation:
Many modern malware strains employ anti-VM or anti-sandbox techniques to remain dormant if they detect they are being analyzed.
Incorrect! Try again.
17What is the function of a 'snapshot' in a virtual machine during malware analysis?
A.To print the code
B.To save the state of the VM so it can be reverted after infection
C.To take a picture of the malware author
D.To record the network traffic
Correct Answer: To save the state of the VM so it can be reverted after infection
Explanation:
Snapshots allow analysts to quickly revert a VM to a clean state after executing malware, facilitating repeated testing.
Incorrect! Try again.
18Which tool is widely used to monitor real-time file system, registry, and process activity on Windows?
A.Process Monitor (ProcMon)
B.Putty
C.FileZilla
D.VLC
Correct Answer: Process Monitor (ProcMon)
Explanation:
ProcMon is a Sysinternals tool that captures real-time file system, registry, and process/thread activity.
Incorrect! Try again.
19In dynamic analysis, what does observing a change in the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' registry key usually indicate?
A.The screen resolution is changing
B.The browser is clearing cache
C.The system is updating
D.The malware is establishing persistence to run on startup
Correct Answer: The malware is establishing persistence to run on startup
Explanation:
The 'Run' keys are common locations for malware to place entries ensuring it executes every time the computer boots.
Incorrect! Try again.
20What is 'Process Injection'?
A.Code belonging to one process being written into the address space of another process
B.Installing a new process via CD
C.Monitoring a process for errors
D.Stopping a process efficiently
Correct Answer: Code belonging to one process being written into the address space of another process
Explanation:
Malware uses process injection to hide within legitimate processes (like explorer.exe) to evade detection and bypass firewalls.
Incorrect! Try again.
21What is a 'Mutex' (Mutual Exclusion) object often used for by malware?
A.To connect to the internet
B.To ensure only one instance of the malware runs at a time
C.To delete system logs
D.To encrypt user files
Correct Answer: To ensure only one instance of the malware runs at a time
Explanation:
Malware authors create a named Mutex to mark the system as infected, preventing multiple instances from running and causing conflicts.
Incorrect! Try again.
22Which network behavior is characteristic of C2 (Command and Control) communication?
A.Periodic 'beaconing' signals to an external server
B.Local printing traffic
C.Windows Update downloads
D.High bandwidth video streaming
Correct Answer: Periodic 'beaconing' signals to an external server
Explanation:
Malware often sends regular signals (beacons) to a C2 server to check for new commands or exfiltrate data.
Incorrect! Try again.
23What is the purpose of using 'FakeNet' or 'INetSim' during dynamic analysis?
A.To hack into the malware author's computer
B.To simulate internet services (DNS, HTTP) so malware thinks it is online
C.To increase internet speed
D.To block all network traffic permanently
Correct Answer: To simulate internet services (DNS, HTTP) so malware thinks it is online
Explanation:
These tools simulate network services, allowing the malware to execute its network functions while keeping the analysis environment isolated from the real internet.
Incorrect! Try again.
24What is a Fileless Malware attack?
A.Malware that only targets empty files
B.Malware that deletes all files on a drive
C.Malware that exists primarily in memory without writing an executable file to the disk
D.Malware transmitted via paper
Correct Answer: Malware that exists primarily in memory without writing an executable file to the disk
Explanation:
Fileless malware leverages system tools and memory to execute malicious code, avoiding traditional file-scanning antivirus detection.
Incorrect! Try again.
25Which term refers to legitimate system tools (like PowerShell) abused by fileless malware?
A.Firmware
B.LOLBins (Living off the Land Binaries)
C.Bloatware
D.Shareware
Correct Answer: LOLBins (Living off the Land Binaries)
Explanation:
LOLBins are legitimate binaries (like powershell.exe or wmic.exe) used by attackers to perform malicious actions while appearing legitimate.
Incorrect! Try again.
26Which of the following is a common entry point for fileless malware?
Fileless malware often enters via web scripts that exploit browser vulnerabilities to inject code directly into memory.
Incorrect! Try again.
27What is the role of WMI (Windows Management Instrumentation) in fileless attacks?
A.It can be used to execute scripts and maintain persistence without files
B.It manages the mouse pointer
C.It acts as a firewall
D.It is used for graphics rendering
Correct Answer: It can be used to execute scripts and maintain persistence without files
Explanation:
Attackers use WMI to subscribe to system events and trigger malicious scripts, allowing persistence without dropping files on disk.
Incorrect! Try again.
28How does Domain Generation Algorithm (DGA) help malware?
A.It generates random domain names to rendezvous with the C2 server, evading blacklists
B.It speeds up the infection process
C.It generates strong passwords for the user
D.It encrypts the hard drive
Correct Answer: It generates random domain names to rendezvous with the C2 server, evading blacklists
Explanation:
DGAs dynamically generate a large number of domain names, making it difficult for defenders to block the C2 infrastructure as it constantly shifts.
Incorrect! Try again.
29Which tool is best suited for capturing and analyzing network packets during malware analysis?
A.RegEdit
B.Resource Hacker
C.Notepad++
D.Wireshark
Correct Answer: Wireshark
Explanation:
Wireshark is the standard network protocol analyzer used to inspect packet-level data to understand malware communication.
Incorrect! Try again.
30What is 'import hashing' (Imphash)?
A.Hashing the file name
B.Hashing the list of imported functions to identify related malware samples
C.Hashing the user's password
D.Hashing the network traffic
Correct Answer: Hashing the list of imported functions to identify related malware samples
Explanation:
Imphash calculates a hash based on the order of imported libraries and functions, helping track malware families that share the same import table structure.
Incorrect! Try again.
31What is a 'Trojan Horse'?
A.Hardware used to steal data
B.Malware disguised as legitimate software to mislead users of its true intent
C.Self-replicating malware
D.Malware that locks the screen
Correct Answer: Malware disguised as legitimate software to mislead users of its true intent
Explanation:
A Trojan Horse appears to be useful software but delivers a malicious payload once installed.
Incorrect! Try again.
32Which component of the PE header contains information about the compilation time of the malware?
A.Subsystem
B.Time Date Stamp
C.Pointer to Symbol Table
D.Machine Type
Correct Answer: Time Date Stamp
Explanation:
The Time Date Stamp in the FILE_HEADER indicates when the binary was compiled, though it can be spoofed.
Incorrect! Try again.
33What does the term 'Obfuscation' mean in malware analysis?
A.Highlighting important code sections
B.Making the code difficult for humans and analysis tools to understand
C.Translating the code to English
D.Deleting the code
Correct Answer: Making the code difficult for humans and analysis tools to understand
Explanation:
Obfuscation techniques (like variable renaming or dead code insertion) are used to complicate reverse engineering efforts.
Incorrect! Try again.
34In the context of PDF analysis, what is a '/OpenAction'?
A.A command that specifies an action to perform immediately upon opening the document
B.A command to close the file
C.A font style
D.A permission setting
Correct Answer: A command that specifies an action to perform immediately upon opening the document
Explanation:
/OpenAction is a PDF element often abused by malware to trigger malicious scripts immediately when the user opens the file.
Incorrect! Try again.
35What is 'Sandboxing'?
A.Encrypting a hard drive
B.Playing a game
C.Cleaning the computer case
D.Automated dynamic analysis in a secure environment
Correct Answer: Automated dynamic analysis in a secure environment
Explanation:
Sandboxes allow for the automated execution of suspected files to generate reports on their behavior without human intervention.
Incorrect! Try again.
36Which of the following is a symptom of Ransomware?
A.The web browser opens multiple tabs
B.The mouse moves slowly
C.Files are encrypted and a payment note is displayed
D.The computer shuts down randomly
Correct Answer: Files are encrypted and a payment note is displayed
Explanation:
Ransomware restricts access to the system or encrypts files and demands a ransom for the decryption key.
Incorrect! Try again.
37What is the primary difference between a Virus and a Worm?
A.Viruses require a host file and user action to spread; Worms are self-replicating and spread automatically
B.Viruses encrypt files; Worms delete them
C.Worms are only for Linux
D.Viruses are hardware-based
Correct Answer: Viruses require a host file and user action to spread; Worms are self-replicating and spread automatically
Explanation:
The defining characteristic is propagation: Viruses attach to files and need execution; worms spread independently across networks.
Incorrect! Try again.
38Why might an analyst check 'Imported Functions' (Imports) in the PE header?
A.To check the author's name
B.To guess what the malware is capable of (e.g., networking, file manipulation)
C.To see the file size
D.To see the icon
Correct Answer: To guess what the malware is capable of (e.g., networking, file manipulation)
Explanation:
Imports list the Windows APIs the malware uses. Seeing 'InternetOpen' suggests network capability; seeing 'WriteFile' suggests disk activity.
Incorrect! Try again.
39What does 'Shellcode' refer to in a malicious document?
A.The name of the file
B.The visual layout of the document
C.The password protection
D.Machine code payload used to exploit a vulnerability
Correct Answer: Machine code payload used to exploit a vulnerability
Explanation:
Shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability.
Incorrect! Try again.
40Which tool allows an analyst to view active TCP and UDP connections in real-time on the host?
A.Calculator
B.Paint
C.Notepad
D.TCPView
Correct Answer: TCPView
Explanation:
TCPView is a Sysinternals utility that shows detailed listings of all TCP and UDP endpoints on the system.
Incorrect! Try again.
41What is 'DLL Injection'?
A.Forcing a process to load a malicious Dynamic Link Library (DLL)
B.Scanning DLLs for viruses
C.Renaming a DLL file
D.Removing a DLL file
Correct Answer: Forcing a process to load a malicious Dynamic Link Library (DLL)
Explanation:
DLL injection is a method used to run malicious code within the address space of another process by forcing it to load a malicious DLL.
Incorrect! Try again.
42What is the 'AutoOpen' macro in Word?
A.A macro that changes the font
B.A macro that saves the file
C.A macro that prints the file
D.A macro that runs automatically when a document is opened
Correct Answer: A macro that runs automatically when a document is opened
Explanation:
AutoOpen is a specific VBA macro name that triggers automatically when a user opens the Word document, often used for initial infection.
Incorrect! Try again.
43How can fileless malware persist using the Windows Registry?
A.By disabling the mouse
B.By storing malicious scripts in registry keys and invoking them via PowerShell
C.By deleting the registry
D.By changing the desktop background
Correct Answer: By storing malicious scripts in registry keys and invoking them via PowerShell
Explanation:
Fileless malware often hides the actual malicious code inside registry blobs and uses a small scheduled task or run key to execute it.
Incorrect! Try again.
44Which network protocol is commonly abused for data exfiltration because it is rarely blocked by firewalls?
A.ICMP
B.DHCP
C.ARP
D.DNS (Domain Name System)
Correct Answer: DNS (Domain Name System)
Explanation:
DNS tunneling involves encoding stolen data into DNS queries, which usually pass through firewalls uninspected.
Incorrect! Try again.
45What is the purpose of 'API Hooking' in malware?
A.To organize files
B.To intercept function calls between the system and applications to modify or monitor behavior
C.To speed up the internet
D.To fix bugs in Windows
Correct Answer: To intercept function calls between the system and applications to modify or monitor behavior
Explanation:
Rootkits and banking trojans use API hooking to intercept data (like keystrokes) or hide their presence from the OS.
Incorrect! Try again.
46Which section of a PE file typically contains the executable code?
A..reloc
B..text
C..data
D..rsrc
Correct Answer: .text
Explanation:
The .text section is the standard location for the executable instructions (code) of the program.
Incorrect! Try again.
47When analyzing a suspicious URL found in malware, what should an analyst do?
A.Open it in their personal browser immediately
B.Ignore it
C.Email the URL to friends
D.Investigate it using reputation services or a safe sandbox environment
Correct Answer: Investigate it using reputation services or a safe sandbox environment
Explanation:
Direct interaction is dangerous. Analysts check reputation (e.g., VirusTotal, WHOIS) or visit via a sandbox.
Incorrect! Try again.
48What is the primary characteristic of a 'Rootkit'?
A.It displays ads
B.It is designed to hide the existence of certain processes or programs from normal detection methods
C.It spreads via USB
D.It encrypts files
Correct Answer: It is designed to hide the existence of certain processes or programs from normal detection methods
Explanation:
Rootkits operate at a deep level (often kernel level) to mask their presence and the presence of other malware.
Incorrect! Try again.
49What is 'Entropy' used for in static malware analysis?
A.To measure the file temperature
B.To count the lines of code
C.To measure the network speed
D.To measure the randomness of data, helping identify packed or encrypted code
Correct Answer: To measure the randomness of data, helping identify packed or encrypted code
Explanation:
High entropy (randomness) usually indicates that the file is packed or encrypted, as compressed/encrypted data looks random.
Incorrect! Try again.
50Why is 'PowerShell' a frequent target for fileless malware?
A.It is a web browser
B.It is not installed on most computers
C.It has deep access to the Windows API and system management functions without needing new binaries
D.It is a game engine
Correct Answer: It has deep access to the Windows API and system management functions without needing new binaries
Explanation:
PowerShell is a powerful, native administration tool. Malware uses it to perform complex actions directly in memory.