CySA+ Test CySA+ Test Malware Analysis 1 — Questions and Answers
Question 1: Which malware analysis technique executes a sample in an isolated environment to observe its behavior without risking production systems?
- Static analysis
- Dynamic analysis (Correct answer)
- Code review
- Signature scanning
Correct answer: Dynamic analysis
Dynamic analysis runs malware in a sandbox to observe runtime behavior such as file writes, network calls, and registry changes.
Question 2: A CySA+ analyst uses a disassembler to examine malware without executing it. This is an example of which analysis type?
- Dynamic analysis
- Behavioral analysis
- Static analysis (Correct answer)
- Live forensics
Correct answer: Static analysis
Static analysis inspects malware code, strings, and structure without running it, often using tools like disassemblers and hex editors.
Question 3: Which indicator would BEST suggest a piece of malware is performing process injection?
- High CPU usage
- Unexpected DLL loaded in a legitimate process memory space (Correct answer)
- Large file size
- Encrypted strings in binary
Correct answer: Unexpected DLL loaded in a legitimate process memory space
Process injection is characterized by a foreign DLL or code being loaded into a legitimate process's memory space to evade detection.
Question 4: Which type of malware is specifically designed to record keystrokes and transmit them to an attacker?
- Ransomware
- Rootkit
- Keylogger (Correct answer)
- Worm
Correct answer: Keylogger
A keylogger captures and logs keyboard input, often to steal credentials or sensitive information.
Question 5: An analyst identifies malware that modifies the Master Boot Record (MBR). Which malware classification BEST fits this behavior?
- Fileless malware
- Bootkit (Correct answer)
- Adware
- Spyware
Correct answer: Bootkit
A bootkit infects the MBR or boot sector, loading before the OS and persisting across reboots.
Question 6: Which tool is commonly used during static malware analysis to extract human-readable text embedded in a binary?
- Wireshark
- strings utility (Correct answer)
- Volatility
- Snort
Correct answer: strings utility
The strings utility extracts printable character sequences from binary files, often revealing URLs, registry keys, or commands.
CySA+ Test CySA+ Test Malware Analysis 1
Which malware analysis technique executes a sample in an isolated environment to observe its behavior without risking production systems?