Malware Forensics
9 practice questions under this official exam objective (312-49v10), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
9 total · page 1 of 1How Should an Investigator Examine a Password-Protected Packed Executable?
This question tests how a malware forensic investigator handles a suspicious executable that is packed with a known program packer and protected by a
What Is an "Idle" System in an IP ID Idle Scan?
An "idle" system is the quiet helper host — the zombie — that an IP ID idle scan borrows to probe a target's ports without revealing the attacker's ad
Fileless Malware Persistence in Windows
Identify the built-in Windows utility leveraged by fileless malware for persistence across reboots. This page establishes that Windows AutoStart regis
Which Volatility Plugin Identifies Hidden Processes and Injected DLLs?
Volatility's malfind plugin scans a RAM dump for hidden processes and injected code or DLLs, making it the correct tool for this memory-forensics scen
ResourcesExtract Malware Static Analysis Purpose
This question examines the specific utility of ResourcesExtract in static malware analysis, clarifying its role in extracting embedded resources versu
Analyzing Password-Protected Packed Malware
This question addresses how to analyze password-protected packed malware without the decryption key. The correct approach is dynamic analysis in a san
What Is a Drive-by Download Attack?
A drive-by download is the unintentional installation of malware triggered simply by visiting a malicious or compromised website that exploits browser
Which Python Script Analyzes Suspicious MS Office Documents?
Static triage of a suspicious MS Office document on an Ubuntu forensic workstation requires an OLE-aware indicator scanner that reports document type,
Identifying Packers Used on Acquired Malware
When an investigator acquires packed software, one of the first triage steps is identifying which packer, cryptor, or compiler produced the binary, be