CEH - Certified Ethical Hacker Practice Questions: Malware Threats Domain

Correct Answer: A

Explanation: Running a full system scan is effective in identifying and potentially removing known malware. Checking logs and rebooting in safe mode can provide more information but will not directly identify malware. Reformatting is drastic and should be a last resort after confirming malware presence.

Correct Answer: C

Explanation: Sandbox detection allows malware to identify when it is running in an analysis environment (like a sandbox) and not execute to avoid detection.

Correct Answer: D

Explanation: Isolating the sample in a sandbox and monitoring its network activity allows safe observation of the malware's behavior, providing valuable intelligence. Blocking the IP and tracing it are important but secondary actions. Submitting to threat intelligence helps with future protection but is not the immediate step.

Correct Answer: B

Explanation: CORRECT: Code obfuscation alters the malware code to avoid detection by signature-based antivirus. OPTION A: Port scanning is a network reconnaissance technique, not for evasion. OPTION B: Correct, as it modifies the code to avoid detection. OPTION C: Packet sniffing is used to capture network traffic, not for evasion. OPTION D: SQL injection is an attack vector, not an evasion technique.

Correct Answer: A

Explanation: An isolated virtual environment with internet access disabled ensures that the malware cannot communicate with external servers. A dual-homed host and bridged network setup could still allow external communication. NAT environments can also permit external access depending on configuration.