1What is the primary definition of malware in the context of digital evidence analysis?
A.Software designed to improve system performance
B.Network protocols used for secure communication
C.Hardware components that fail due to overheating
D.Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system
Correct Answer: Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system
Explanation:
Malware is a contraction for 'malicious software' and encompasses any program or file that is harmful to a computer user.
Incorrect! Try again.
2Which of the following is a common technique used by attackers to spread malware via email?
A.Phishing
B.Port Scanning
C.SQL Injection
D.Packet Sniffing
Correct Answer: Phishing
Explanation:
Phishing involves sending fraudulent emails resembling reputable sources to induce individuals to reveal personal information or download malicious attachments.
Incorrect! Try again.
3What is a 'Drive-by Download'?
A.Downloading software from a physical drive
B.Copying files from a USB stick
C.Manually downloading a file from an email
D.Unintended download of malicious code by visiting a compromised website
Correct Answer: Unintended download of malicious code by visiting a compromised website
Explanation:
Drive-by downloads occur when a user visits a website that exploits browser vulnerabilities to install malware without the user's knowledge.
Incorrect! Try again.
4Which term describes malicious advertisements used to distribute malware?
A.Adware
B.Malvertising
C.Ransomware
D.Spyware
Correct Answer: Malvertising
Explanation:
Malvertising involves injecting malicious code into legitimate online advertising networks to infect users who view the ads.
Incorrect! Try again.
5What is the primary goal of Malware Forensics?
A.To understand the capabilities, origin, and impact of a malicious sample
B.To repair broken hardware
C.To increase network speed
D.To design new antivirus software
Correct Answer: To understand the capabilities, origin, and impact of a malicious sample
Explanation:
Malware forensics focuses on analyzing malicious code to determine what it does, how it works, and who created it to support incident response.
Incorrect! Try again.
6Which analysis type involves examining the malware without executing it?
A.Static Analysis
B.Memory Forensics
C.Behavioral Analysis
D.Dynamic Analysis
Correct Answer: Static Analysis
Explanation:
Static analysis involves reviewing the code, structure, and metadata of a file without running it to ensure safety during the initial examination.
Incorrect! Try again.
7Which environment is most recommended for performing malware analysis to prevent infection of the host system?
A.A public Wi-Fi network
B.An isolated Virtual Machine (VM) or Sandbox
C.Production Server
D.The analyst's personal laptop
Correct Answer: An isolated Virtual Machine (VM) or Sandbox
Explanation:
Isolated environments like VMs ensure that if the malware executes, the damage is contained and does not spread to the host or network.
Incorrect! Try again.
8In Static Analysis, what is the purpose of calculating the file hash (MD5, SHA256)?
A.To identify the file uniquely and check against databases like VirusTotal
B.To execute the file safely
C.To compress the file size
D.To decrypt the file
Correct Answer: To identify the file uniquely and check against databases like VirusTotal
Explanation:
Hashes act as a digital fingerprint, allowing analysts to identify known malware variants without analyzing the code from scratch.
Incorrect! Try again.
9What tool is commonly used in static analysis to extract readable text strings from a binary?
A.Wireshark
B.Process Monitor
C.Fiddler
D.Strings
Correct Answer: Strings
Explanation:
The 'Strings' utility extracts ASCII and Unicode characters from a binary, often revealing IP addresses, URLs, or file paths.
Incorrect! Try again.
10What does 'packing' refer to in the context of malware?
A.Bundling malware with legitimate software
B.Zipping a file for email
C.Compressing or encrypting the executable to hide its code and evade detection
D.Adding more features to the malware
Correct Answer: Compressing or encrypting the executable to hide its code and evade detection
Explanation:
Packing obfuscates the malware's true code, making static analysis difficult until the code is unpacked in memory.
Incorrect! Try again.
11Which file format is the standard executable format for Windows, often analyzed during malware forensics?
A.APK
B.Mach-O
C.PE (Portable Executable)
D.ELF
Correct Answer: PE (Portable Executable)
Explanation:
The PE format is the standard for executables, object code, and DLLs in Windows operating systems.
Incorrect! Try again.
12When analyzing a suspicious PDF, what specific element is often looked for as a vector for malicious code?
A.Page margins
B.Text formatting
C.JavaScript
D.Image resolution
Correct Answer: JavaScript
Explanation:
Attackers often embed malicious JavaScript within PDFs to exploit vulnerabilities in PDF readers when the document is opened.
Incorrect! Try again.
13What is a common indicator of a malicious Microsoft Word document?
A.The document having a .docx extension
B.The file size being under 1MB
C.The use of Arial font
D.The presence of VBA Macros (Visual Basic for Applications)
Correct Answer: The presence of VBA Macros (Visual Basic for Applications)
Explanation:
VBA Macros are frequently used to download and execute payloads when a user enables content in a Word document.
Incorrect! Try again.
14Which tool is specifically designed to analyze the structure of OLE (Object Linking and Embedding) streams in Office documents?
A.Burp Suite
B.Oledump.py
C.Metasploit
D.Nmap
Correct Answer: Oledump.py
Explanation:
Oledump.py is a standard tool for analyzing OLE files (like Word documents) to identify and extract malicious macro streams.
Incorrect! Try again.
15What is 'Dynamic Malware Analysis'?
A.Scanning the file with an antivirus
B.Running the malware in a controlled environment to observe its behavior
C.Reading the source code
D.Checking the file creation date
Correct Answer: Running the malware in a controlled environment to observe its behavior
Explanation:
Dynamic analysis involves executing the sample to monitor its interaction with the file system, registry, and network.
Incorrect! Try again.
16Which of the following is a risk associated with Dynamic Analysis?
A.The malware might detect the virtual environment and stop running
B.It is only useful for text files
C.It requires access to the source code
D.It cannot identify network traffic
Correct Answer: The malware might detect the virtual environment and stop running
Explanation:
Many modern malware strains employ anti-VM or anti-sandbox techniques to remain dormant if they detect they are being analyzed.
Incorrect! Try again.
17What is the function of a 'snapshot' in a virtual machine during malware analysis?
A.To print the code
B.To save the state of the VM so it can be reverted after infection
C.To record the network traffic
D.To take a picture of the malware author
Correct Answer: To save the state of the VM so it can be reverted after infection
Explanation:
Snapshots allow analysts to quickly revert a VM to a clean state after executing malware, facilitating repeated testing.
Incorrect! Try again.
18Which tool is widely used to monitor real-time file system, registry, and process activity on Windows?
A.Putty
B.VLC
C.Process Monitor (ProcMon)
D.FileZilla
Correct Answer: Process Monitor (ProcMon)
Explanation:
ProcMon is a Sysinternals tool that captures real-time file system, registry, and process/thread activity.
Incorrect! Try again.
19In dynamic analysis, what does observing a change in the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' registry key usually indicate?
A.The malware is establishing persistence to run on startup
B.The system is updating
C.The screen resolution is changing
D.The browser is clearing cache
Correct Answer: The malware is establishing persistence to run on startup
Explanation:
The 'Run' keys are common locations for malware to place entries ensuring it executes every time the computer boots.
Incorrect! Try again.
20What is 'Process Injection'?
A.Code belonging to one process being written into the address space of another process
B.Installing a new process via CD
C.Stopping a process efficiently
D.Monitoring a process for errors
Correct Answer: Code belonging to one process being written into the address space of another process
Explanation:
Malware uses process injection to hide within legitimate processes (like explorer.exe) to evade detection and bypass firewalls.
Incorrect! Try again.
21What is a 'Mutex' (Mutual Exclusion) object often used for by malware?
A.To connect to the internet
B.To delete system logs
C.To ensure only one instance of the malware runs at a time
D.To encrypt user files
Correct Answer: To ensure only one instance of the malware runs at a time
Explanation:
Malware authors create a named Mutex to mark the system as infected, preventing multiple instances from running and causing conflicts.
Incorrect! Try again.
22Which network behavior is characteristic of C2 (Command and Control) communication?
A.Periodic 'beaconing' signals to an external server
B.Windows Update downloads
C.Local printing traffic
D.High bandwidth video streaming
Correct Answer: Periodic 'beaconing' signals to an external server
Explanation:
Malware often sends regular signals (beacons) to a C2 server to check for new commands or exfiltrate data.
Incorrect! Try again.
23What is the purpose of using 'FakeNet' or 'INetSim' during dynamic analysis?
A.To hack into the malware author's computer
B.To simulate internet services (DNS, HTTP) so malware thinks it is online
C.To block all network traffic permanently
D.To increase internet speed
Correct Answer: To simulate internet services (DNS, HTTP) so malware thinks it is online
Explanation:
These tools simulate network services, allowing the malware to execute its network functions while keeping the analysis environment isolated from the real internet.
Incorrect! Try again.
24What is a Fileless Malware attack?
A.Malware that only targets empty files
B.Malware that exists primarily in memory without writing an executable file to the disk
C.Malware transmitted via paper
D.Malware that deletes all files on a drive
Correct Answer: Malware that exists primarily in memory without writing an executable file to the disk
Explanation:
Fileless malware leverages system tools and memory to execute malicious code, avoiding traditional file-scanning antivirus detection.
Incorrect! Try again.
25Which term refers to legitimate system tools (like PowerShell) abused by fileless malware?
A.Bloatware
B.Shareware
C.Firmware
D.LOLBins (Living off the Land Binaries)
Correct Answer: LOLBins (Living off the Land Binaries)
Explanation:
LOLBins are legitimate binaries (like powershell.exe or wmic.exe) used by attackers to perform malicious actions while appearing legitimate.
Incorrect! Try again.
26Which of the following is a common entry point for fileless malware?
Fileless malware often enters via web scripts that exploit browser vulnerabilities to inject code directly into memory.
Incorrect! Try again.
27What is the role of WMI (Windows Management Instrumentation) in fileless attacks?
A.It manages the mouse pointer
B.It can be used to execute scripts and maintain persistence without files
C.It is used for graphics rendering
D.It acts as a firewall
Correct Answer: It can be used to execute scripts and maintain persistence without files
Explanation:
Attackers use WMI to subscribe to system events and trigger malicious scripts, allowing persistence without dropping files on disk.
Incorrect! Try again.
28How does Domain Generation Algorithm (DGA) help malware?
A.It generates strong passwords for the user
B.It generates random domain names to rendezvous with the C2 server, evading blacklists
C.It encrypts the hard drive
D.It speeds up the infection process
Correct Answer: It generates random domain names to rendezvous with the C2 server, evading blacklists
Explanation:
DGAs dynamically generate a large number of domain names, making it difficult for defenders to block the C2 infrastructure as it constantly shifts.
Incorrect! Try again.
29Which tool is best suited for capturing and analyzing network packets during malware analysis?
A.RegEdit
B.Wireshark
C.Notepad++
D.Resource Hacker
Correct Answer: Wireshark
Explanation:
Wireshark is the standard network protocol analyzer used to inspect packet-level data to understand malware communication.
Incorrect! Try again.
30What is 'import hashing' (Imphash)?
A.Hashing the network traffic
B.Hashing the user's password
C.Hashing the file name
D.Hashing the list of imported functions to identify related malware samples
Correct Answer: Hashing the list of imported functions to identify related malware samples
Explanation:
Imphash calculates a hash based on the order of imported libraries and functions, helping track malware families that share the same import table structure.
Incorrect! Try again.
31What is a 'Trojan Horse'?
A.Hardware used to steal data
B.Self-replicating malware
C.Malware disguised as legitimate software to mislead users of its true intent
D.Malware that locks the screen
Correct Answer: Malware disguised as legitimate software to mislead users of its true intent
Explanation:
A Trojan Horse appears to be useful software but delivers a malicious payload once installed.
Incorrect! Try again.
32Which component of the PE header contains information about the compilation time of the malware?
A.Pointer to Symbol Table
B.Machine Type
C.Time Date Stamp
D.Subsystem
Correct Answer: Time Date Stamp
Explanation:
The Time Date Stamp in the FILE_HEADER indicates when the binary was compiled, though it can be spoofed.
Incorrect! Try again.
33What does the term 'Obfuscation' mean in malware analysis?
A.Making the code difficult for humans and analysis tools to understand
B.Translating the code to English
C.Highlighting important code sections
D.Deleting the code
Correct Answer: Making the code difficult for humans and analysis tools to understand
Explanation:
Obfuscation techniques (like variable renaming or dead code insertion) are used to complicate reverse engineering efforts.
Incorrect! Try again.
34In the context of PDF analysis, what is a '/OpenAction'?
A.A command to close the file
B.A font style
C.A command that specifies an action to perform immediately upon opening the document
D.A permission setting
Correct Answer: A command that specifies an action to perform immediately upon opening the document
Explanation:
/OpenAction is a PDF element often abused by malware to trigger malicious scripts immediately when the user opens the file.
Incorrect! Try again.
35What is 'Sandboxing'?
A.Automated dynamic analysis in a secure environment
B.Playing a game
C.Cleaning the computer case
D.Encrypting a hard drive
Correct Answer: Automated dynamic analysis in a secure environment
Explanation:
Sandboxes allow for the automated execution of suspected files to generate reports on their behavior without human intervention.
Incorrect! Try again.
36Which of the following is a symptom of Ransomware?
A.Files are encrypted and a payment note is displayed
B.The web browser opens multiple tabs
C.The mouse moves slowly
D.The computer shuts down randomly
Correct Answer: Files are encrypted and a payment note is displayed
Explanation:
Ransomware restricts access to the system or encrypts files and demands a ransom for the decryption key.
Incorrect! Try again.
37What is the primary difference between a Virus and a Worm?
A.Viruses require a host file and user action to spread; Worms are self-replicating and spread automatically
B.Viruses are hardware-based
C.Worms are only for Linux
D.Viruses encrypt files; Worms delete them
Correct Answer: Viruses require a host file and user action to spread; Worms are self-replicating and spread automatically
Explanation:
The defining characteristic is propagation: Viruses attach to files and need execution; worms spread independently across networks.
Incorrect! Try again.
38Why might an analyst check 'Imported Functions' (Imports) in the PE header?
A.To guess what the malware is capable of (e.g., networking, file manipulation)
B.To see the icon
C.To see the file size
D.To check the author's name
Correct Answer: To guess what the malware is capable of (e.g., networking, file manipulation)
Explanation:
Imports list the Windows APIs the malware uses. Seeing 'InternetOpen' suggests network capability; seeing 'WriteFile' suggests disk activity.
Incorrect! Try again.
39What does 'Shellcode' refer to in a malicious document?
A.Machine code payload used to exploit a vulnerability
B.The password protection
C.The name of the file
D.The visual layout of the document
Correct Answer: Machine code payload used to exploit a vulnerability
Explanation:
Shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability.
Incorrect! Try again.
40Which tool allows an analyst to view active TCP and UDP connections in real-time on the host?
A.Notepad
B.Paint
C.Calculator
D.TCPView
Correct Answer: TCPView
Explanation:
TCPView is a Sysinternals utility that shows detailed listings of all TCP and UDP endpoints on the system.
Incorrect! Try again.
41What is 'DLL Injection'?
A.Scanning DLLs for viruses
B.Forcing a process to load a malicious Dynamic Link Library (DLL)
C.Renaming a DLL file
D.Removing a DLL file
Correct Answer: Forcing a process to load a malicious Dynamic Link Library (DLL)
Explanation:
DLL injection is a method used to run malicious code within the address space of another process by forcing it to load a malicious DLL.
Incorrect! Try again.
42What is the 'AutoOpen' macro in Word?
A.A macro that runs automatically when a document is opened
B.A macro that prints the file
C.A macro that changes the font
D.A macro that saves the file
Correct Answer: A macro that runs automatically when a document is opened
Explanation:
AutoOpen is a specific VBA macro name that triggers automatically when a user opens the Word document, often used for initial infection.
Incorrect! Try again.
43How can fileless malware persist using the Windows Registry?
A.By changing the desktop background
B.By disabling the mouse
C.By deleting the registry
D.By storing malicious scripts in registry keys and invoking them via PowerShell
Correct Answer: By storing malicious scripts in registry keys and invoking them via PowerShell
Explanation:
Fileless malware often hides the actual malicious code inside registry blobs and uses a small scheduled task or run key to execute it.
Incorrect! Try again.
44Which network protocol is commonly abused for data exfiltration because it is rarely blocked by firewalls?
A.DNS (Domain Name System)
B.DHCP
C.ARP
D.ICMP
Correct Answer: DNS (Domain Name System)
Explanation:
DNS tunneling involves encoding stolen data into DNS queries, which usually pass through firewalls uninspected.
Incorrect! Try again.
45What is the purpose of 'API Hooking' in malware?
A.To intercept function calls between the system and applications to modify or monitor behavior
B.To speed up the internet
C.To organize files
D.To fix bugs in Windows
Correct Answer: To intercept function calls between the system and applications to modify or monitor behavior
Explanation:
Rootkits and banking trojans use API hooking to intercept data (like keystrokes) or hide their presence from the OS.
Incorrect! Try again.
46Which section of a PE file typically contains the executable code?
A..text
B..reloc
C..data
D..rsrc
Correct Answer: .text
Explanation:
The .text section is the standard location for the executable instructions (code) of the program.
Incorrect! Try again.
47When analyzing a suspicious URL found in malware, what should an analyst do?
A.Ignore it
B.Open it in their personal browser immediately
C.Email the URL to friends
D.Investigate it using reputation services or a safe sandbox environment
Correct Answer: Investigate it using reputation services or a safe sandbox environment
Explanation:
Direct interaction is dangerous. Analysts check reputation (e.g., VirusTotal, WHOIS) or visit via a sandbox.
Incorrect! Try again.
48What is the primary characteristic of a 'Rootkit'?
A.It is designed to hide the existence of certain processes or programs from normal detection methods
B.It displays ads
C.It spreads via USB
D.It encrypts files
Correct Answer: It is designed to hide the existence of certain processes or programs from normal detection methods
Explanation:
Rootkits operate at a deep level (often kernel level) to mask their presence and the presence of other malware.
Incorrect! Try again.
49What is 'Entropy' used for in static malware analysis?
A.To measure the randomness of data, helping identify packed or encrypted code
B.To measure the network speed
C.To measure the file temperature
D.To count the lines of code
Correct Answer: To measure the randomness of data, helping identify packed or encrypted code
Explanation:
High entropy (randomness) usually indicates that the file is packed or encrypted, as compressed/encrypted data looks random.
Incorrect! Try again.
50Why is 'PowerShell' a frequent target for fileless malware?
A.It is a web browser
B.It is not installed on most computers
C.It has deep access to the Windows API and system management functions without needing new binaries
D.It is a game engine
Correct Answer: It has deep access to the Windows API and system management functions without needing new binaries
Explanation:
PowerShell is a powerful, native administration tool. Malware uses it to perform complex actions directly in memory.