1What is the primary definition of malware in the context of digital evidence analysis?
A.Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system
B.Network protocols used for secure communication
C.Software designed to improve system performance
D.Hardware components that fail due to overheating
Correct Answer: Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system
Explanation:
Malware is a contraction for 'malicious software' and encompasses any program or file that is harmful to a computer user.
Incorrect! Try again.
2Which of the following is a common technique used by attackers to spread malware via email?
A.Port Scanning
B.SQL Injection
C.Packet Sniffing
D.Phishing
Correct Answer: Phishing
Explanation:
Phishing involves sending fraudulent emails resembling reputable sources to induce individuals to reveal personal information or download malicious attachments.
Incorrect! Try again.
3What is a 'Drive-by Download'?
A.Manually downloading a file from an email
B.Downloading software from a physical drive
C.Unintended download of malicious code by visiting a compromised website
D.Copying files from a USB stick
Correct Answer: Unintended download of malicious code by visiting a compromised website
Explanation:
Drive-by downloads occur when a user visits a website that exploits browser vulnerabilities to install malware without the user's knowledge.
Incorrect! Try again.
4Which term describes malicious advertisements used to distribute malware?
A.Adware
B.Ransomware
C.Spyware
D.Malvertising
Correct Answer: Malvertising
Explanation:
Malvertising involves injecting malicious code into legitimate online advertising networks to infect users who view the ads.
Incorrect! Try again.
5What is the primary goal of Malware Forensics?
A.To increase network speed
B.To design new antivirus software
C.To repair broken hardware
D.To understand the capabilities, origin, and impact of a malicious sample
Correct Answer: To understand the capabilities, origin, and impact of a malicious sample
Explanation:
Malware forensics focuses on analyzing malicious code to determine what it does, how it works, and who created it to support incident response.
Incorrect! Try again.
6Which analysis type involves examining the malware without executing it?
A.Behavioral Analysis
B.Memory Forensics
C.Static Analysis
D.Dynamic Analysis
Correct Answer: Static Analysis
Explanation:
Static analysis involves reviewing the code, structure, and metadata of a file without running it to ensure safety during the initial examination.
Incorrect! Try again.
7Which environment is most recommended for performing malware analysis to prevent infection of the host system?
A.Production Server
B.An isolated Virtual Machine (VM) or Sandbox
C.A public Wi-Fi network
D.The analyst's personal laptop
Correct Answer: An isolated Virtual Machine (VM) or Sandbox
Explanation:
Isolated environments like VMs ensure that if the malware executes, the damage is contained and does not spread to the host or network.
Incorrect! Try again.
8In Static Analysis, what is the purpose of calculating the file hash (MD5, SHA256)?
A.To decrypt the file
B.To execute the file safely
C.To compress the file size
D.To identify the file uniquely and check against databases like VirusTotal
Correct Answer: To identify the file uniquely and check against databases like VirusTotal
Explanation:
Hashes act as a digital fingerprint, allowing analysts to identify known malware variants without analyzing the code from scratch.
Incorrect! Try again.
9What tool is commonly used in static analysis to extract readable text strings from a binary?
A.Process Monitor
B.Wireshark
C.Strings
D.Fiddler
Correct Answer: Strings
Explanation:
The 'Strings' utility extracts ASCII and Unicode characters from a binary, often revealing IP addresses, URLs, or file paths.
Incorrect! Try again.
10What does 'packing' refer to in the context of malware?
A.Zipping a file for email
B.Compressing or encrypting the executable to hide its code and evade detection
C.Bundling malware with legitimate software
D.Adding more features to the malware
Correct Answer: Compressing or encrypting the executable to hide its code and evade detection
Explanation:
Packing obfuscates the malware's true code, making static analysis difficult until the code is unpacked in memory.
Incorrect! Try again.
11Which file format is the standard executable format for Windows, often analyzed during malware forensics?
A.Mach-O
B.PE (Portable Executable)
C.APK
D.ELF
Correct Answer: PE (Portable Executable)
Explanation:
The PE format is the standard for executables, object code, and DLLs in Windows operating systems.
Incorrect! Try again.
12When analyzing a suspicious PDF, what specific element is often looked for as a vector for malicious code?
A.Text formatting
B.Image resolution
C.Page margins
D.JavaScript
Correct Answer: JavaScript
Explanation:
Attackers often embed malicious JavaScript within PDFs to exploit vulnerabilities in PDF readers when the document is opened.
Incorrect! Try again.
13What is a common indicator of a malicious Microsoft Word document?
A.The document having a .docx extension
B.The presence of VBA Macros (Visual Basic for Applications)
C.The use of Arial font
D.The file size being under 1MB
Correct Answer: The presence of VBA Macros (Visual Basic for Applications)
Explanation:
VBA Macros are frequently used to download and execute payloads when a user enables content in a Word document.
Incorrect! Try again.
14Which tool is specifically designed to analyze the structure of OLE (Object Linking and Embedding) streams in Office documents?
A.Burp Suite
B.Metasploit
C.Nmap
D.Oledump.py
Correct Answer: Oledump.py
Explanation:
Oledump.py is a standard tool for analyzing OLE files (like Word documents) to identify and extract malicious macro streams.
Incorrect! Try again.
15What is 'Dynamic Malware Analysis'?
A.Reading the source code
B.Scanning the file with an antivirus
C.Running the malware in a controlled environment to observe its behavior
D.Checking the file creation date
Correct Answer: Running the malware in a controlled environment to observe its behavior
Explanation:
Dynamic analysis involves executing the sample to monitor its interaction with the file system, registry, and network.
Incorrect! Try again.
16Which of the following is a risk associated with Dynamic Analysis?
A.It cannot identify network traffic
B.It is only useful for text files
C.It requires access to the source code
D.The malware might detect the virtual environment and stop running
Correct Answer: The malware might detect the virtual environment and stop running
Explanation:
Many modern malware strains employ anti-VM or anti-sandbox techniques to remain dormant if they detect they are being analyzed.
Incorrect! Try again.
17What is the function of a 'snapshot' in a virtual machine during malware analysis?
A.To save the state of the VM so it can be reverted after infection
B.To print the code
C.To take a picture of the malware author
D.To record the network traffic
Correct Answer: To save the state of the VM so it can be reverted after infection
Explanation:
Snapshots allow analysts to quickly revert a VM to a clean state after executing malware, facilitating repeated testing.
Incorrect! Try again.
18Which tool is widely used to monitor real-time file system, registry, and process activity on Windows?
A.VLC
B.Putty
C.FileZilla
D.Process Monitor (ProcMon)
Correct Answer: Process Monitor (ProcMon)
Explanation:
ProcMon is a Sysinternals tool that captures real-time file system, registry, and process/thread activity.
Incorrect! Try again.
19In dynamic analysis, what does observing a change in the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' registry key usually indicate?
A.The system is updating
B.The browser is clearing cache
C.The screen resolution is changing
D.The malware is establishing persistence to run on startup
Correct Answer: The malware is establishing persistence to run on startup
Explanation:
The 'Run' keys are common locations for malware to place entries ensuring it executes every time the computer boots.
Incorrect! Try again.
20What is 'Process Injection'?
A.Monitoring a process for errors
B.Stopping a process efficiently
C.Code belonging to one process being written into the address space of another process
D.Installing a new process via CD
Correct Answer: Code belonging to one process being written into the address space of another process
Explanation:
Malware uses process injection to hide within legitimate processes (like explorer.exe) to evade detection and bypass firewalls.
Incorrect! Try again.
21What is a 'Mutex' (Mutual Exclusion) object often used for by malware?
A.To connect to the internet
B.To delete system logs
C.To encrypt user files
D.To ensure only one instance of the malware runs at a time
Correct Answer: To ensure only one instance of the malware runs at a time
Explanation:
Malware authors create a named Mutex to mark the system as infected, preventing multiple instances from running and causing conflicts.
Incorrect! Try again.
22Which network behavior is characteristic of C2 (Command and Control) communication?
A.Windows Update downloads
B.Local printing traffic
C.Periodic 'beaconing' signals to an external server
D.High bandwidth video streaming
Correct Answer: Periodic 'beaconing' signals to an external server
Explanation:
Malware often sends regular signals (beacons) to a C2 server to check for new commands or exfiltrate data.
Incorrect! Try again.
23What is the purpose of using 'FakeNet' or 'INetSim' during dynamic analysis?
A.To block all network traffic permanently
B.To hack into the malware author's computer
C.To simulate internet services (DNS, HTTP) so malware thinks it is online
D.To increase internet speed
Correct Answer: To simulate internet services (DNS, HTTP) so malware thinks it is online
Explanation:
These tools simulate network services, allowing the malware to execute its network functions while keeping the analysis environment isolated from the real internet.
Incorrect! Try again.
24What is a Fileless Malware attack?
A.Malware transmitted via paper
B.Malware that exists primarily in memory without writing an executable file to the disk
C.Malware that only targets empty files
D.Malware that deletes all files on a drive
Correct Answer: Malware that exists primarily in memory without writing an executable file to the disk
Explanation:
Fileless malware leverages system tools and memory to execute malicious code, avoiding traditional file-scanning antivirus detection.
Incorrect! Try again.
25Which term refers to legitimate system tools (like PowerShell) abused by fileless malware?
A.Firmware
B.Shareware
C.LOLBins (Living off the Land Binaries)
D.Bloatware
Correct Answer: LOLBins (Living off the Land Binaries)
Explanation:
LOLBins are legitimate binaries (like powershell.exe or wmic.exe) used by attackers to perform malicious actions while appearing legitimate.
Incorrect! Try again.
26Which of the following is a common entry point for fileless malware?
Fileless malware often enters via web scripts that exploit browser vulnerabilities to inject code directly into memory.
Incorrect! Try again.
27What is the role of WMI (Windows Management Instrumentation) in fileless attacks?
A.It manages the mouse pointer
B.It acts as a firewall
C.It is used for graphics rendering
D.It can be used to execute scripts and maintain persistence without files
Correct Answer: It can be used to execute scripts and maintain persistence without files
Explanation:
Attackers use WMI to subscribe to system events and trigger malicious scripts, allowing persistence without dropping files on disk.
Incorrect! Try again.
28How does Domain Generation Algorithm (DGA) help malware?
A.It speeds up the infection process
B.It generates random domain names to rendezvous with the C2 server, evading blacklists
C.It encrypts the hard drive
D.It generates strong passwords for the user
Correct Answer: It generates random domain names to rendezvous with the C2 server, evading blacklists
Explanation:
DGAs dynamically generate a large number of domain names, making it difficult for defenders to block the C2 infrastructure as it constantly shifts.
Incorrect! Try again.
29Which tool is best suited for capturing and analyzing network packets during malware analysis?
A.RegEdit
B.Wireshark
C.Notepad++
D.Resource Hacker
Correct Answer: Wireshark
Explanation:
Wireshark is the standard network protocol analyzer used to inspect packet-level data to understand malware communication.
Incorrect! Try again.
30What is 'import hashing' (Imphash)?
A.Hashing the user's password
B.Hashing the list of imported functions to identify related malware samples
C.Hashing the file name
D.Hashing the network traffic
Correct Answer: Hashing the list of imported functions to identify related malware samples
Explanation:
Imphash calculates a hash based on the order of imported libraries and functions, helping track malware families that share the same import table structure.
Incorrect! Try again.
31What is a 'Trojan Horse'?
A.Hardware used to steal data
B.Malware that locks the screen
C.Self-replicating malware
D.Malware disguised as legitimate software to mislead users of its true intent
Correct Answer: Malware disguised as legitimate software to mislead users of its true intent
Explanation:
A Trojan Horse appears to be useful software but delivers a malicious payload once installed.
Incorrect! Try again.
32Which component of the PE header contains information about the compilation time of the malware?
A.Pointer to Symbol Table
B.Subsystem
C.Machine Type
D.Time Date Stamp
Correct Answer: Time Date Stamp
Explanation:
The Time Date Stamp in the FILE_HEADER indicates when the binary was compiled, though it can be spoofed.
Incorrect! Try again.
33What does the term 'Obfuscation' mean in malware analysis?
A.Translating the code to English
B.Deleting the code
C.Making the code difficult for humans and analysis tools to understand
D.Highlighting important code sections
Correct Answer: Making the code difficult for humans and analysis tools to understand
Explanation:
Obfuscation techniques (like variable renaming or dead code insertion) are used to complicate reverse engineering efforts.
Incorrect! Try again.
34In the context of PDF analysis, what is a '/OpenAction'?
A.A font style
B.A permission setting
C.A command to close the file
D.A command that specifies an action to perform immediately upon opening the document
Correct Answer: A command that specifies an action to perform immediately upon opening the document
Explanation:
/OpenAction is a PDF element often abused by malware to trigger malicious scripts immediately when the user opens the file.
Incorrect! Try again.
35What is 'Sandboxing'?
A.Automated dynamic analysis in a secure environment
B.Playing a game
C.Encrypting a hard drive
D.Cleaning the computer case
Correct Answer: Automated dynamic analysis in a secure environment
Explanation:
Sandboxes allow for the automated execution of suspected files to generate reports on their behavior without human intervention.
Incorrect! Try again.
36Which of the following is a symptom of Ransomware?
A.The computer shuts down randomly
B.The mouse moves slowly
C.Files are encrypted and a payment note is displayed
D.The web browser opens multiple tabs
Correct Answer: Files are encrypted and a payment note is displayed
Explanation:
Ransomware restricts access to the system or encrypts files and demands a ransom for the decryption key.
Incorrect! Try again.
37What is the primary difference between a Virus and a Worm?
A.Worms are only for Linux
B.Viruses are hardware-based
C.Viruses encrypt files; Worms delete them
D.Viruses require a host file and user action to spread; Worms are self-replicating and spread automatically
Correct Answer: Viruses require a host file and user action to spread; Worms are self-replicating and spread automatically
Explanation:
The defining characteristic is propagation: Viruses attach to files and need execution; worms spread independently across networks.
Incorrect! Try again.
38Why might an analyst check 'Imported Functions' (Imports) in the PE header?
A.To guess what the malware is capable of (e.g., networking, file manipulation)
B.To see the file size
C.To check the author's name
D.To see the icon
Correct Answer: To guess what the malware is capable of (e.g., networking, file manipulation)
Explanation:
Imports list the Windows APIs the malware uses. Seeing 'InternetOpen' suggests network capability; seeing 'WriteFile' suggests disk activity.
Incorrect! Try again.
39What does 'Shellcode' refer to in a malicious document?
A.The name of the file
B.The visual layout of the document
C.Machine code payload used to exploit a vulnerability
D.The password protection
Correct Answer: Machine code payload used to exploit a vulnerability
Explanation:
Shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability.
Incorrect! Try again.
40Which tool allows an analyst to view active TCP and UDP connections in real-time on the host?
A.Notepad
B.TCPView
C.Calculator
D.Paint
Correct Answer: TCPView
Explanation:
TCPView is a Sysinternals utility that shows detailed listings of all TCP and UDP endpoints on the system.
Incorrect! Try again.
41What is 'DLL Injection'?
A.Renaming a DLL file
B.Removing a DLL file
C.Scanning DLLs for viruses
D.Forcing a process to load a malicious Dynamic Link Library (DLL)
Correct Answer: Forcing a process to load a malicious Dynamic Link Library (DLL)
Explanation:
DLL injection is a method used to run malicious code within the address space of another process by forcing it to load a malicious DLL.
Incorrect! Try again.
42What is the 'AutoOpen' macro in Word?
A.A macro that prints the file
B.A macro that runs automatically when a document is opened
C.A macro that saves the file
D.A macro that changes the font
Correct Answer: A macro that runs automatically when a document is opened
Explanation:
AutoOpen is a specific VBA macro name that triggers automatically when a user opens the Word document, often used for initial infection.
Incorrect! Try again.
43How can fileless malware persist using the Windows Registry?
A.By storing malicious scripts in registry keys and invoking them via PowerShell
B.By changing the desktop background
C.By disabling the mouse
D.By deleting the registry
Correct Answer: By storing malicious scripts in registry keys and invoking them via PowerShell
Explanation:
Fileless malware often hides the actual malicious code inside registry blobs and uses a small scheduled task or run key to execute it.
Incorrect! Try again.
44Which network protocol is commonly abused for data exfiltration because it is rarely blocked by firewalls?
A.DHCP
B.ICMP
C.ARP
D.DNS (Domain Name System)
Correct Answer: DNS (Domain Name System)
Explanation:
DNS tunneling involves encoding stolen data into DNS queries, which usually pass through firewalls uninspected.
Incorrect! Try again.
45What is the purpose of 'API Hooking' in malware?
A.To intercept function calls between the system and applications to modify or monitor behavior
B.To organize files
C.To speed up the internet
D.To fix bugs in Windows
Correct Answer: To intercept function calls between the system and applications to modify or monitor behavior
Explanation:
Rootkits and banking trojans use API hooking to intercept data (like keystrokes) or hide their presence from the OS.
Incorrect! Try again.
46Which section of a PE file typically contains the executable code?
A..text
B..rsrc
C..reloc
D..data
Correct Answer: .text
Explanation:
The .text section is the standard location for the executable instructions (code) of the program.
Incorrect! Try again.
47When analyzing a suspicious URL found in malware, what should an analyst do?
A.Ignore it
B.Email the URL to friends
C.Open it in their personal browser immediately
D.Investigate it using reputation services or a safe sandbox environment
Correct Answer: Investigate it using reputation services or a safe sandbox environment
Explanation:
Direct interaction is dangerous. Analysts check reputation (e.g., VirusTotal, WHOIS) or visit via a sandbox.
Incorrect! Try again.
48What is the primary characteristic of a 'Rootkit'?
A.It displays ads
B.It spreads via USB
C.It is designed to hide the existence of certain processes or programs from normal detection methods
D.It encrypts files
Correct Answer: It is designed to hide the existence of certain processes or programs from normal detection methods
Explanation:
Rootkits operate at a deep level (often kernel level) to mask their presence and the presence of other malware.
Incorrect! Try again.
49What is 'Entropy' used for in static malware analysis?
A.To measure the network speed
B.To measure the randomness of data, helping identify packed or encrypted code
C.To measure the file temperature
D.To count the lines of code
Correct Answer: To measure the randomness of data, helping identify packed or encrypted code
Explanation:
High entropy (randomness) usually indicates that the file is packed or encrypted, as compressed/encrypted data looks random.
Incorrect! Try again.
50Why is 'PowerShell' a frequent target for fileless malware?
A.It is a game engine
B.It has deep access to the Windows API and system management functions without needing new binaries
C.It is not installed on most computers
D.It is a web browser
Correct Answer: It has deep access to the Windows API and system management functions without needing new binaries
Explanation:
PowerShell is a powerful, native administration tool. Malware uses it to perform complex actions directly in memory.