CySA+ Test CySA+ Test Malware Analysis 2 — Questions and Answers
Question 1: A sandbox report shows a sample making repeated DNS requests to randomly generated domain names. Which malware technique does this indicate?
- Domain fronting
- Domain generation algorithm (DGA) (Correct answer)
- DNS tunneling
- Sinkholing
Correct answer: Domain generation algorithm (DGA)
A domain generation algorithm (DGA) programmatically creates many pseudo-random domain names to make C2 infrastructure hard to block.
Question 2: Which artifact should an analyst examine to identify persistence mechanisms established by malware on a Windows host?
- Windows Event Log ID 4624
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key (Correct answer)
- ARP cache
- DHCP lease file
Correct answer: HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key
The Run registry key is a common persistence location where malware adds entries to execute automatically at startup.
Question 3: An analyst observes that malware deletes Volume Shadow Copies. Which type of malware MOST commonly uses this technique?
- Spyware
- Ransomware (Correct answer)
- Adware
- Rootkit
Correct answer: Ransomware
Ransomware deletes Volume Shadow Copies to prevent victims from restoring encrypted files from local backups.
Question 4: Which memory forensics tool is widely used to analyze malware artifacts from a RAM dump?
- Nmap
- Metasploit
- Volatility (Correct answer)
- Burp Suite
Correct answer: Volatility
Volatility is the industry-standard open-source framework for memory forensics, capable of extracting processes, DLLs, and network connections from RAM dumps.
Question 5: A CySA+ analyst observes that a malware sample uses HTTPS to communicate with its C2 server, making traffic appear legitimate. Which technique is this?
- Port knocking
- Encrypted C2 channel (Correct answer)
- ARP poisoning
- SQL injection
Correct answer: Encrypted C2 channel
Using HTTPS for C2 communication blends malicious traffic with normal web traffic, making it harder to detect via inspection.
Question 6: Which hashing algorithm is MOST commonly used to generate file reputation hashes (IOCs) for malware samples?
- MD5
- SHA-256 (Correct answer)
- bcrypt
- HMAC-SHA1
Correct answer: SHA-256
SHA-256 is the standard for malware IOC hashing due to its collision resistance and wide adoption in threat intelligence platforms.
CySA+ Test CySA+ Test Malware Analysis 2
A sandbox report shows a sample making repeated DNS requests to randomly generated domain names.
Which malware technique does this indicate?