CySA+ Test CySA+ Test Malware Analysis 2

Question 1

A sandbox report shows a sample making repeated DNS requests to randomly generated domain names. Which malware technique does this indicate?

Accepted Answer

Domain generation algorithm (DGA)

Answer

A domain generation algorithm (DGA) programmatically creates many pseudo-random domain names to make C2 infrastructure hard to block.

Question 2

Which artifact should an analyst examine to identify persistence mechanisms established by malware on a Windows host?

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key

Answer

The Run registry key is a common persistence location where malware adds entries to execute automatically at startup.

Question 3

An analyst observes that malware deletes Volume Shadow Copies. Which type of malware MOST commonly uses this technique?

Accepted Answer

Ransomware

Answer

Ransomware deletes Volume Shadow Copies to prevent victims from restoring encrypted files from local backups.

Question 4

Which memory forensics tool is widely used to analyze malware artifacts from a RAM dump?

Accepted Answer

Volatility

Answer

Volatility is the industry-standard open-source framework for memory forensics, capable of extracting processes, DLLs, and network connections from RAM dumps.

Question 5

A CySA+ analyst observes that a malware sample uses HTTPS to communicate with its C2 server, making traffic appear legitimate. Which technique is this?

Accepted Answer

Encrypted C2 channel

Answer

Using HTTPS for C2 communication blends malicious traffic with normal web traffic, making it harder to detect via inspection.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test CySA+ Test Malware Analysis 2