Preparing a Sheep Dip Computer for Malware Analysis
A security analyst is preparing to analyze a potentially malicious program believed to have infiltrated an organization's network. To ensure the safety and integrity of the production environment, the analyst decided to use a sheep dip computer for the analysis. Before initiating the analysis, what key step should the analyst take?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the correct preparation sequence for malware analysis on a sheep dip machine; the trap is choosing an action that involves executing or network-connecting the sample before isolation is established.
A sheep dip computer is an isolated workstation used to analyze suspected malware without endangering the production network. Before analysis begins, the suspicious program must be stored on write-once external media such as a CD-ROM, keeping the sample off shared storage and preventing accidental network spread.
Option C is the tempting wrong pick because analysts instinctively want to run the sample to observe behavior, but running the program is the analysis step itself — not the required preparatory step — and doing it prematurely risks uncontrolled propagation.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because the CEH curriculum specifies that before analysis on a sheep dip computer, downloaded or suspicious programs should be saved to external media such as CD-ROM or DVD, which is read-only and cannot be silently modified or used as a propagation path. This step preserves the original sample, keeps it off shared network storage, and guarantees the isolated machine receives the malware in a controlled, deliberate manner. It is explicitly framed as the action taken "before initiating the analysis," matching the question's timing.Why the Other Options Are Wrong
Option A installs the program on the sheep dip computer, which is part of performing the analysis rather than the preparatory step the question asks about. Option C runs the program to observe behavior, which is the actual analysis phase and would be dangerous if isolation and sample staging have not been completed first. Option D connects the sheep dip computer to the internal network, which defeats its entire purpose and could release the malware into production, since the machine must remain physically and logically isolated.Community Comment Notes
Community participants converged on B, with one citing "CEH v12 Module 7 page 1085" for storing downloaded programs on CD-ROM or DVD before isolating and analyzing. Another echoed the exact option wording and the same module/page reference, while a third conceded that "none of the other option make sense (even B is questionable but is the least questionable one)" — reflecting that B is the only answer consistent with safe, isolated handling.Exam Strategy
Read the timing cue in the stem — "before initiating the analysis" — and eliminate any option describing execution, installation, or network connectivity, since those belong to the analysis itself or violate isolation of the sheep dip machine.
Frequently Asked Questions
Why is running the malware on the sheep dip computer the wrong first step?
Running the sample is the analysis itself, not the preparation step. The sample must first be staged safely on read-only media while the machine stays isolated from the network.
Why must the sheep dip computer stay off the internal network?
A sheep dip computer exists precisely to be physically and logically isolated; connecting it to the network risks releasing the malware into the production environment.