MALWARE ANALYSIS EXAMINATION ADVANCED VERSION QUESTIONS AND CORRECT ANSWER WITH EXPLANATION GRADED A+ STUDY GUIDE

MALWARE ANALYSIS EXAMINATION ADVANCED
VERSION QUESTIONS AND CORRECT ANSWER WITH
EXPLANATION GRADED A+ STUDY GUIDE SOUTHERN
NEW HAMPSHIRE UNIVERSITY

1. Advanced malware analysis primarily focuses on:

A. Deep reverse engineering and behavior tracking
B. Basic browsing safety
C. Hardware installation
D. Word processing
Answer: A
Rationale: Advanced analysis studies internal structure and behavior.



2. In malware analysis, unpacking refers to:

A. Extracting original code from packed malware
B. Compressing files
C. Deleting malware
D. Encrypting disk
Answer: A
Rationale: Reveals hidden payload.



3. Packers are mainly used to:

A. Obfuscate malware code
B. Speed up CPU
C. Clean system
D. Update OS
Answer: A
Rationale: Hide malicious code.



4. A common anti-analysis technique is:

,A. Time delay execution
B. Logging
C. Debugging
D. Monitoring
Answer: A
Rationale: Evades sandbox detection.



5. Malware often checks for sandbox environments by:

A. Detecting virtual artifacts
B. Increasing RAM
C. Checking disk size
D. Checking CPU brand
Answer: A
Rationale: Avoids analysis environments.



6. API monitoring helps analysts to:

A. Track malware function calls
B. Increase CPU speed
C. Store files
D. Encrypt disk
Answer: A
Rationale: Observes runtime behavior.



7. Inline hooking is used to:

A. Intercept function calls
B. Speed up execution
C. Compress malware
D. Store logs
Answer: A
Rationale: Monitors malware behavior.



8. Malware entropy analysis helps to:

, A. Detect packed/encrypted files
B. Increase CPU speed
C. Improve RAM
D. Optimize storage
Answer: A
Rationale: High entropy indicates obfuscation.



9. High entropy in a file usually indicates:

A. Encryption or packing
B. Clean file
C. Text file
D. Image file
Answer: A
Rationale: Randomized data pattern.



10. A common reverse engineering tool is:

A. Ghidra
B. Excel
C. Word
D. PowerPoint
Answer: A
Rationale: Malware disassembly tool.



11. IDA Pro is used for:

A. Disassembly and analysis
B. File storage
C. Network routing
D. CPU tuning
Answer: A
Rationale: Reverse engineering tool.



12. Dynamic analysis requires: