Preparing a Sheep Dip Computer for Malware Analysis
Short answer
B Store the potentially malicious program on write-once external media such as a CD-ROM before beginning analysis on the isolated sheep dip computer.
Question
Key Takeaways
The question tests the correct preparation sequence for malware analysis on a sheep dip machine; the trap is choosing an action that involves executing or network-connecting the sample before isolation is established.
A sheep dip computer is an isolated workstation used to analyze suspected malware without endangering the production network. Before analysis begins, the suspicious program must be stored on write-once external media such as a CD-ROM, keeping the sample off shared storage and preventing accidental network spread.
Common mistake: Option C is the tempting wrong pick because analysts instinctively want to run the sample to observe behavior, but running the program is the analysis step itself — not the required preparatory step — and doing it prematurely risks uncontrolled propagation.
Expert Analysis
Why the Answer Is Correct
Option B is correct because the CEH curriculum specifies that before analysis on a sheep dip computer, downloaded or suspicious programs should be saved to external media such as CD-ROM or DVD, which is read-only and cannot be silently modified or used as a propagation path. This step preserves the original sample, keeps it off shared network storage, and guarantees the isolated machine receives the malware in a controlled, deliberate manner. It is explicitly framed as the action taken "before initiating the analysis," matching the question's timing.
Why the Other Options Are Wrong
Option A installs the program on the sheep dip computer, which is part of performing the analysis rather than the preparatory step the question asks about. Option C runs the program to observe behavior, which is the actual analysis phase and would be dangerous if isolation and sample staging have not been completed first. Option D connects the sheep dip computer to the internal network, which defeats its entire purpose and could release the malware into production, since the machine must remain physically and logically isolated.
Community Comment Notes
Community participants converged on B, with one citing "CEH v12 Module 7 page 1085" for storing downloaded programs on CD-ROM or DVD before isolating and analyzing. Another echoed the exact option wording and the same module/page reference, while a third conceded that "none of the other option make sense (even B is questionable but is the least questionable one)" — reflecting that B is the only answer consistent with safe, isolated handling.
Exam Strategy
Read the timing cue in the stem — "before initiating the analysis" — and eliminate any option describing execution, installation, or network connectivity, since those belong to the analysis itself or violate isolation of the sheep dip machine.
Frequently Asked Questions
Why is running the malware on the sheep dip computer the wrong first step?
Why must the sheep dip computer stay off the internal network?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
a68d338 👍 3 Answered BThe user isolate the sheep dip computer from others computer on the network to block any malware entering in the system. Before performing this process it is important to save all downloaded programs on external media such as CD ROMS and DVD. CEH v12 Module 7 page 1085
-
insaniunt 👍 3B. Store the potentially malicious program on an external medium, such as a CD-ROM. - Module 07 Page 1085
-
LordXander 👍 2 Answered BI mean, none of the other option make sense (even B is questionable but is the least questionable one)
-
qwerty100 👍 2 Answered BB. Store the potentially malicious program on an external medium, such as a CD-ROM.
-
qtygbapjpesdayazko 👍 1keyword "Before initiating the analysis", store the malware in a CD-ROM.
Show 1 more comment
-
rorahir 👍 1Team can you confirm if this is accurate"
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.