Wayground logo

Free Printable Worksheets

Font size

S
M
L
XL
Worksheets

CHFI Module 11 Malware Forensics

Total questions: 15

Worksheet time: 8mins

Name
Class
Date
1.

Malware testing should be done on what type of system?

a)

investigators computer

b)

standalone computer

c)

any computer

d)

internet capable computer

2.

IDA Pro is a widely used program for malware disassembly

a)

True

b)

False

3.

You can check the startup folders by using the run command shell:startup

a)

True

b)

False

4.

To examine the start-up process, investigators can check the _______ _______ list for viewing services that start automatically when the system boots.

a)

startup services

b)

Windows services

c)

system logs

d)

Registry log

5.

Components of malware are dependent upon ______________

a)

The person receiving the malware attack

b)

Both the sender and receiver of the malware attack

c)

The person who authored the malware attack

d)

The type of machine being used

6.

The command netstat -an displays all active TCP connections as well as the TCP and UDP ports on which the computer is listening along with addresses and port numbers.

a)

True

b)

False

7.

Process monitor is an important tool for Dynamic Malware Analysis

a)

True

b)

False

8.

Dynamic Analysis is executing the malware and static is analyzing the code without executing it.

a)

True

b)

False

9.

Disassembly of code is not part of Static Malware Analysis

a)

True

b)

False

10.

In static analysis, you are analyzing code but not running it.

a)

True

b)

False

11.

There are ___ types of malware forensics

a)

4

b)

2

c)

3

d)

6

12.

Which configuration file is used in the Linux and UNIX based system to maintain logs of what happened in the system?

a)

Send.conf

b)

Wphost.db

c)

Mail.conf

d)

Syslog.conf

13.

There are some common techniques used by the attackers to distribute malware across internet. One such technique is mimicking legitimate institutions in an attempt to steal login credentials is come under which category?

a)

Social Engineered Clickjacking

b)

Compromised Legitimate Websites

c)

Spear Phishing Sites

d)

Blackhat Search Engine Optimization (SEO)

14.

In Port Monitoring the following command is used to look for connection established to unknown or suspicious IP addresses.

a)

netstat -n

b)

netstat-ns

c)

netstat-na

d)

netstat-sn

15.

Identify the following common techniques used by the attackers to distribute the malware across the web.


‘Hosting embedded malware sites that spreads to unsuspecting visitors’ comes under which of the following technique.

a)

social engineering

b)

Compromised Legitimate Websites

c)

malvertising

d)

spear phishing sites